Land Phase 2 / F14: trigger axis (`skillet run --axis trigger`) — deterministic description testing with whole-corpus frontmatter stubs #16

	# Free CI — the model-free merge gate (constitution V: "CI in this repo is the Linux user").
	#
	# Both jobs run the full unit + integration suite with ZERO secrets and ZERO paid model
	# calls: the one paid test (the live smoke) is opt-in env-gated (SKILLET_LIVE_SMOKE) and
	# self-skips here — the same pattern lm-evaluation-harness and Inspect AI use for their
	# PR gates (evidence: Roadmap/phase-1-review.md §8, M1). Never add a provider credential
	# to this workflow; paid validation stays a local, consented, env-gated run.
	name: CI

	on:
	push:
	branches: [main]
	pull_request:

	permissions: {}

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	macos:
	name: macOS (Swift 6.3)
	runs-on: macos-26
	permissions:
	contents: read
	env:
	# Pinned Xcode for determinism; any Swift 6 Xcode works.
	DEVELOPER_DIR: "/Applications/Xcode_26.5.app/Contents/Developer"
	steps:
	- uses: actions/checkout@v6
	- name: Toolchain
	run: swift --version
	- name: Build
	run: swift build
	- name: Test (free suite — live smoke self-skips)
	run: swift test

	linux:
	name: Ubuntu (Swift 6.3)
	runs-on: ubuntu-latest
	container: swift:6.3 # official Swift image — deterministic toolchain, no third-party setup action
	permissions:
	contents: read
	steps:
	- uses: actions/checkout@v6
	- name: Toolchain
	run: swift --version
	- name: Build
	run: swift build
	- name: Test (free suite — live smoke self-skips)
	run: swift test

Provide feedback