ci: Gate every push and PR on tests and the maximum pub.dev score

[srthkpthk]

Summary

Makes the pub.dev score a hard gate instead of a one-off local run. Every push to master and every PR now runs:

• test — dart format --set-exit-if-changed, dart analyze --fatal-infos, dart test --exclude-tags live, and a check that lib/src/models/*.g.dart match a fresh dart run build_runner build.
• score — pana --json, per-section breakdown in the job summary, pana.json uploaded as an artifact, and the job fails unless grantedPoints == maxPoints.

pana is the same tool pub.dev runs on published packages, so a green score job on master is the score the listing will show after dart pub publish.

Verification

Local run of exactly what the workflow executes, on master @ a2b9684:

$ dart run build_runner build && dart format lib/src/models && git diff --exit-code -- lib/src/models
Built with build_runner/aot in 14s; wrote 20 outputs.
Formatted 27 files (0 changed)
diff exit=0

$ dart pub global run pana --json --no-warning . | jq '{granted: .scores.grantedPoints, max: .scores.maxPoints}'
{"granted":160,"max":160}

The first real run is this PR's own checks.

🤖 Generated with Claude Code

Greptile Summary

The PR adds CI gates for formatting, analysis, tests, generated-code consistency, and the maximum pub.dev score, with supporting documentation and a README badge.

• Runs validation on pull requests and pushes to master.
• Uploads the generated pana report as a workflow artifact.
• Pins external GitHub Actions to immutable commit SHAs and restricts workflow permissions to read-only repository contents.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	Adds the test and pub.dev score jobs; the previously reported mutable Action references are now pinned to full commit SHAs.
CLAUDE.md	Documents the new CI checks and the local command for reproducing the pub.dev score.
README.md	Adds a badge linking to the new CI workflow.

_{Reviews (2): Last reviewed commit: "ci: Pin actions to commit SHAs and drop ..." | Re-trigger Greptile}