GitHub CI now

Ask /evalglass ci (an alias of setup --ci) and your agent copies a workflow that runs the vendored runtime and exits on the run's ci_should_fail flag. It adds no verdict logic of its own — only the Verdict Engine decides — and it references neither the plugin nor an agent, so CI keeps working on its own. A fresh run gates nothing; the build can only fail after you approve a gate in your config.