feat: establish production facade composition root

.github/workflows/real-verification.yml

@@ -0,0 +1,58 @@
+name: real-verification
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# These jobs deliberately use the CAD self-hosted runner. The runner image must
+# contain Chrome, CMake/Ninja, Emscripten, and the pinned CAMotics/OpenCAMLib/
+# LinuxCNC worktrees described in docs/ci-real-verification.zh-CN.md.
+jobs:
+  chrome:
+    runs-on: [self-hosted, linux, cad]
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22.23.2
+          cache: npm
+      - run: ./npmw ci --ignore-scripts
+      - run: ./npmw run ci:real -- --lane=chrome
+        env:
+          CHROME_BIN: ${{ vars.CHROME_BIN }}
+
+  freecad-oracle:
+    runs-on: [self-hosted, linux, cad]
+    timeout-minutes: 180
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22.23.2
+          cache: npm
+      - run: ./npmw ci --ignore-scripts
+      - run: ./npmw run ci:real -- --lane=oracle
+        env:
+          FREECAD_ORACLE_PROFILE: headless
+
+  wasm:
+    runs-on: [self-hosted, linux, cad]
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22.23.2
+          cache: npm
+      - run: ./npmw ci --ignore-scripts
+      - run: ./npmw run ci:real -- --lane=wasm
+        env:
+          CHROME_BIN: ${{ vars.CHROME_BIN }}
+          EMSDK: ${{ vars.EMSDK }}
+          OCCT_SOURCE_DIR: ${{ vars.OCCT_SOURCE_DIR }}