[codex] enforce quality gate

[starlight02]

What changed

• Add a dedicated CI workflow with a stable quality job for PR and main/master push checks.
• Configure local docs to distinguish bypassable lefthook checks from the non-bypassable remote gate.
• Fix local file:// media URI normalization and add regression coverage for local, localhost, remote-host, and relative paths.
• Replace the registration-only adapter import in main.py with an explicit side-effect module import so pyright reports 0 warnings.

Why

Local commit hooks can be bypassed with --no-verify, so the repository needs an enforced GitHub status check on the protected default branch. The media URI bug and pyright warning were already identified in this working tree and are included so the quality gate starts from a clean baseline.

Validation

• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/ci.yml"); YAML.load_file(".github/workflows/release.yml"); puts "workflow yaml ok"'
• ruff check .
• ruff format --check .
• pyright rocketchat_*.py main.py
• python3 -m py_compile rocketchat_adapter.py rocketchat_realtime.py rocketchat_inbound.py rocketchat_sender.py rocketchat_e2ee.py rocketchat_event.py rocketchat_media.py main.py
• python3 -m unittest discover -s tests -p "test_*.py" -v
• git commit pre-commit gate: pyright, ruff-check, ruff-format, unittest all passed

Branch protection

Configured main protection with required status check quality, strict up-to-date checks, pull-request gating, admin enforcement, and force-push/delete disabled.