M2: Generate GitHub Actions mirror workflow

[dbrosio3]

Goal

Generate a GitHub Actions workflow that mirrors configured local blocking checks.

User value

Teams keep the convenience of pre-push checks without relying on local hooks as final enforcement, since git push --no-verify can bypass them.

Implementation notes

• Add a command such as pushgate ci emit github-actions.
• Generate a workflow at .github/workflows/pushgate.yml or a configured path.
• Reuse the same normalized config and check definitions where possible.
• Document how to combine the workflow with branch protection.

Risks / tradeoffs

• Package manager setup differs heavily across projects.
• GitHub Actions may not be the only desired CI provider long term.

Suggested priority

P0

Milestone

M2: CI mirror

TBD considerations

• Whether GitHub Actions is the only P0 CI target.
• How much CI environment setup should be generated vs documented.

Acceptance criteria

• A valid GitHub Actions workflow can be generated from v2 config.
• Generated workflow runs deterministic blocking checks.
• Workflow generation is covered by golden-file tests.