[PROOF-P0-S3] Run the suite on pull requests

.github/workflows/suite.yml

@@ -0,0 +1,53 @@
+# Runs the suite, `bash tests/run.sh`, on every pull request and on every push to main.
+#
+# A pull request is checked as GitHub would merge it into its base (refs/pull/<n>/merge), so the
+# result is for the merged tree and not only for the branch. A pull request that conflicts with
+# its base has no merge tree, and this check does not start for it.
+#
+# There is no path filter. A check that skips some changes stays "expected" forever on the pull
+# requests it skips, which blocks a merge if the author makes this check required.
+name: suite
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+# The suite reads the repository and writes nothing to it. It uses no secret.
+permissions:
+  contents: read
+
+jobs:
+  suite:
+    name: bash tests/run.sh
+    # A pinned image: Bash, python3, node, and git change when this line changes, not when GitHub
+    # moves the "latest" label. README.md says what the suite needs: Bash 4+, python3, Node 20+.
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      # tests/run.sh runs the skills' commands under zsh, the shell Claude Code uses on macOS, and
+      # skips that part when zsh is not installed. In CI a skipped part is not a pass, so install it.
+      # The Ruff version is pinned: a new Ruff can add findings, and an unpinned one would turn a
+      # pull request red for a change that did not cause it. To bump it, run
+      # `ruff check scripts tests` with the new version first, then change the number here.
+      # The suite fails when the CI variable is set and Ruff is missing (section 20).
+      - name: Install zsh and Ruff
+        run: |
+          command -v zsh >/dev/null 2>&1 || { sudo apt-get update -q && sudo apt-get install -y -q zsh; }
+          pipx install 'ruff==0.15.15'
+
+      - name: Show tool versions
+        run: |
+          bash --version | head -1
+          zsh --version
+          python3 --version
+          node --version
+          git --version
+          ruff --version
+
+      - name: Run the suite
+        run: bash tests/run.sh

docs/plan/2026-10-12-any-document-as-a-proof.md

@@ -17,7 +17,7 @@ The names and the checks are put in place before anything is built. When it ends
 | Stage | What | Who | State |
 |---|---|---|---|
 | P0-S0 | The staged-plan release merged, pull request 25 | You | done (25) |
-| P0-S1 | The lint gate, a waiting state for the suite, and the checks for every later stage | Robin, Opus | not started; could start now |
+| P0-S1 | The lint gate, a waiting state for the suite, and the checks for every later stage | Robin, Opus | running in its session |
 | P0-S2 | The review page renamed to the proof, everywhere | Sasha, Sonnet | not started; follows S1 |
 | P0-S3 | A check that runs the suite on every pull request | Alex, Sonnet | not started; follows S1 |