ci: gate pushes on a build, test and bundle

Migrated from musiikki/nih-plug-template, adapted for this repo: the
template gates VST3 behind an opt-in `vst3` feature and so builds twice,
while this plugin always ships VST3 (nih_plug is taken with its default
features), so one build covers both formats.

The branding check runs first because it needs no toolchain and finishes
in under a second, so a half-landed rename fails before a build is spent
on it. The bundle step is included because `cargo build` never exercises
the xtask bundler, and bundler.toml drifting from the crate name stays
invisible until you try to produce an artifact.

Performance is deliberately not gated. `Plugin::process()` cannot be
called from a test — `ProcessContext` requires a `&Transport`, whose
constructor and fields are `pub(crate)` to nih_plug — so any realtime
check would have to target the `src/dsp/` types directly, and a meaningful
one needs an audio deadline rather than a shared CI box.

Verified by running the exact step sequence as the gitea-runner user under
the service's environment: 28 branding checks, 20 unit tests, both bundles
produced.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WHt4DykxXaQnyaJfyS8KCn

README.md

@@ -291,6 +291,23 @@ which no source licence resolves. CLAP carries neither encumbrance.
  
 ---
  
+## CI
+
+`.github/workflows/ci.yaml` gates pushes and PRs on the branding check, a release build,
+`cargo test`, and a bundle — enough to catch a rename that only half-landed, a build break,
+or a `bundler.toml` that no longer matches the crate name.
+
+It targets `runs-on: rust-audio`, a self-hosted host-mode runner registered to the `musiikki`
+org. That label is org-scoped: a fork outside `musiikki` will not see the runner and its jobs
+will queue indefinitely rather than fail.
+
+Plugin performance is deliberately not gated. Realtime cost is only meaningful against an
+audio deadline, and `Plugin::process()` cannot be called from a test at all — `ProcessContext`
+requires a `&Transport`, whose constructor and fields are `pub(crate)` to nih_plug. The DSP
+types under `src/dsp/` take no nih-plug context and are directly testable if you need it.
+
+---
+
 ## Reference Material
  
 - [NIH-plug repo](https://github.com/robbert-vdh/nih-plug) — read the `plugins/` examples first