github-actions

Adding Validation and Eval Gates to CI with WIQD

Run WIQD unattended in GitHub Actions: validate manifests, build packages, gate a bounded eval suite, and keep tenant credentials away from untrusted pull requests.