[ekinnee]

Summary

• Add an advisory production build job to .github/workflows/quality.yml for non-draft code PRs targeting release/** and Mergify queue branches.
• Mirror the full CI production build recipe: Node 24, npm-ci-retry, check:node-runtime, and npm run build with OMNIROUTE_USE_TURBOPACK=1.
• Document the one-week advisory period and update release-green / quality-gate docs.

Related Issues

• Closes feat(backend): close CI gap — next build never runs on PRs into release/** #7307

Validation

Run only the focused loop for what you changed — the full unit suite, Vitest, the
60% coverage gate, and the production build all run in CI on this PR (#8329):

• Focused tests for the change: node --import tsx/esm --test tests/unit/build/check-workflows.test.ts
• npm run lint attempted; it fails on existing dashboard/shared React Compiler/react-hooks findings outside this PR's changed files.
• Production-code changes include a new or updated automated test in this PR: not applicable, no production code changed.
• SonarQube PR analysis is green or any remaining issues are explicitly documented below

Additional validation:

• actionlint .github/workflows/quality.yml
• npm run check:docs-all
• Installed actionlint 1.7.12 and zizmor 1.28.0; npm run check:workflows -- --strict now runs but fails on the existing zizmor backlog.
• npm run check:workflows -- --ratchet reports 181 findings vs baseline 176; clean origin/release/v3.8.49 reports the same 181 with the same installed tool versions, so this is pre-existing/tool-version drift, not introduced here.

Tests Added Or Updated

• tests/unit/build/check-workflows.test.ts

Coverage Notes

No production code changed; this is workflow, docs, and test coverage for CI configuration.

Reviewer Notes

• The new build job is intentionally advisory via continue-on-error: true; remove that after one week of stable release-PR runs.
• The job skips artifact upload because no downstream quality.yml job consumes a build artifact.
• The new third-party action refs in the build job are pinned to SHAs to avoid increasing zizmor findings.