Go-live runtime sync and control plane hardening (#1)

* Implement Mika runtime sync and go-live controls

* Add CI validation workflow

* Align CI with validated runtime checks

* Fix Mika CI install workflow

.github/workflows/validate.yml

@@ -0,0 +1,63 @@
+name: Validate Mika Agent Assist
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+      - "codex/**"
+  workflow_dispatch:
+
+jobs:
+  frontend-build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        run: npm install --legacy-peer-deps
+
+      - name: Build frontend
+        run: npm run build
+
+  edge-functions:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Deno
+        uses: denoland/setup-deno@v2
+        with:
+          deno-version: 2.7.14
+
+      - name: Type-check edge functions
+        shell: bash
+        run: |
+          files=(
+            supabase/functions/_shared/hermes-config.ts
+            supabase/functions/_shared/runtime-sync.ts
+            supabase/functions/sync-agent-runtime/index.ts
+            supabase/functions/sync-agent-skills/index.ts
+            supabase/functions/keep-alive-agents/index.ts
+            supabase/functions/provision-agent/index.ts
+            supabase/functions/publish-skill-version/index.ts
+            supabase/functions/railway-webhook/index.ts
+            supabase/functions/update-agent-config/index.ts
+            supabase/functions/list-ollama-models/index.ts
+            supabase/functions/oauth-callback/index.ts
+            supabase/functions/disconnect-integration/index.ts
+            supabase/functions/refresh-integration-token/index.ts
+          )
+          deno check --config supabase/functions/deno.json "${files[@]}"