ci: gate pushes on a build of both feature sets

Adds the minimal check a plugin repo actually needs: does it still build,
and do the identity strings still agree.

Both feature sets are built rather than just the default, because the
`vst3` cfg gates are exactly the kind of thing that rots — a default build
never compiles the Vst3Plugin impl, so a break there would otherwise
surface only when someone tried to ship a VST3. The bundle step is
included for the same reason: `cargo build` never exercises the xtask
bundler, and bundler.toml drifting from the crate name is invisible until
you try to produce an artifact.

The branding check runs first because it needs no toolchain and finishes
in under a second, so a half-landed rename fails before a build is spent
on it.

Performance testing is deliberately absent. Realtime cost is only
meaningful against an audio deadline, and `Plugin::process()` cannot be
called from a test at all: `ProcessContext` requires a `&Transport`, whose
constructor and fields are `pub(crate)` to nih_plug, so no external crate
can implement the trait. A static lint for locks in the audio path was
considered and dropped — `lock` and `borrow` are ordinary identifiers, not
reserved words, so a substring search matches every occurrence of "block"
in DSP code while missing `println!`, `recv()` and `Condvar::wait()`,
which are the likelier offenders. `assert_process_allocs` remains the real
guarantee, and it only fires in a debug build inside a host.

Verified by running the exact step sequence as the gitea-runner user under
the service's environment.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WHt4DykxXaQnyaJfyS8KCn

README.md

@@ -107,8 +107,25 @@ xtask/              # Bundler xtask (cargo xtask bundle)
 .cargo/config.toml  # xtask alias
 check-branding.sh   # Asserts the plugin's identity strings agree everywhere (see Renaming)
 .gitattributes      # Pins *.sh to LF so Windows checkouts keep a valid shebang
+.github/workflows/  # CI: branding check, both feature sets build, test, bundle
 ```
 
+## CI
+
+`.github/workflows/ci.yaml` gates pushes and PRs on the branding check, a build of both
+feature sets, `cargo test`, and a bundle — enough to catch a rename that only half-landed,
+a `cfg(feature = "vst3")` gate that stopped compiling, or a `bundler.toml` that no longer
+matches the crate name.
+
+It targets `runs-on: rust-audio`, an **org-scoped** runner label. A plugin cloned into a
+different org will not see that runner and its jobs will queue indefinitely rather than fail
+— register a runner advertising the label for that org, or change `runs-on`.
+
+Deliberately not covered: plugin performance. Realtime cost can only be measured meaningfully
+against a real audio deadline, and `Plugin::process()` cannot be called from a test at all
+(`ProcessContext` requires a `Transport`, whose constructor and fields are `pub(crate)` to
+nih-plug). Benchmark your DSP types directly if you need it.
+
 ## License
 
 **GPL-3.0-or-later.** See `LICENSE` for the terms and `NOTICE` for third-party attribution.