ci: add manually-triggered Cross Platform Builds workflow

[stack72]

Summary

• Adds .github/workflows/cross-platform-builds.yml, a manually-triggered workflow that runs the full pipeline (lint, check, test, compile) on windows-latest and macos-latest.
• Triggered via workflow_dispatch only — does not run on PRs, pushes, or a schedule, so there's no CI noise on regular work.
• First step in incremental Windows-support effort. The first run produces the failure inventory we'll work through; subsequent runs verify progress.

How to invoke

Via GitHub UI: Actions → Cross Platform Builds → Run workflow

Or CLI:

gh workflow run cross-platform-builds.yml

Why workflow_dispatch only?

Until Windows support exists, every triggered run will fail loudly. Wiring it to PRs or a schedule would mean red checks / red emails on every workday — alert fatigue, and the signal stops being useful. On-demand runs let us capture the failure list when we want it (now, and after each Windows-support PR) without polluting unrelated work.

Once Windows support is complete, a follow-up PR can flip the triggers to pull_request and remove this manual step.

Test plan

• Open and merge PR.
• From the Actions tab, manually trigger "Cross Platform Builds" against main.
• Confirm both Cross Platform Build (windows-latest) and Cross Platform Build (macos-latest) jobs run independently (fail-fast: false keeps macOS running when Windows fails).
• Capture the Windows failure list to inform PR 2.

🤖 Generated with Claude Code

[github-actions]

Code Review

Blocking Issues

None.

Suggestions

None — this is a clean, minimal addition.

Details:

The workflow mirrors the existing ci.yml test job exactly — same actions (actions/checkout@v6, denoland/setup-deno@v2), same commands (deno lint, deno fmt --check, deno task check, deno task test, deno task compile), and appropriately minimal permissions (contents: read).

Checked:

• CLAUDE.md conventions: No TypeScript changes, so no license headers, type checks, linting, or formatting concerns. The workflow commands match the established patterns.
• DDD: Not applicable — no domain code changed.
• Test coverage: Not applicable — no code requiring tests.
• Security: workflow_dispatch with no inputs means no injection surface. No secrets used. Permissions are read-only. Third-party action pins match the existing CI convention.
• Consistency: fail-fast: false is the right choice for an exploratory failure-inventory run across independent platforms.

LGTM.

[github-actions]

CI Security Review

Critical / High

None.

Medium

1. .github/workflows/cross-platform-builds.yml:19,22 — actions/checkout@v6 and denoland/setup-deno@v2 are pinned by tag rather than full commit SHA. A compromised tag could deliver malicious code. However, both are from trusted publishers (GitHub-owned / Deno official), and the existing ci.yml in this repo uses the same tag-only pinning for these actions, so this is consistent with current repo convention. Consider SHA-pinning as a future hardening pass across all workflows.

Low

None.

Verdict

PASS — This is a clean, minimal workflow. It is workflow_dispatch-only (no external trigger surface), uses job-level contents: read permissions (minimum necessary), interpolates no untrusted data, references no secrets, and invokes no LLMs. The tag-only action pins are a medium-severity note but are consistent with existing repo practice and use trusted publishers.