[codex] ci: add public harness guard

[PerishCode]

What changed

• Add a public CI workflow for PR and main pushes.
• Split the repo into a minimal pnpm workspace:
  • @html-anything/next owns the complete Next app under next/.
  • @html-anything/e2e owns Playwright as the sole browser-test source under e2e/.
  • root owns CI, docs, workspace metadata, and scripts/guard.ts.
• Add scripts/guard.ts to enforce the root / next / e2e project shape.
• Move the existing UI smoke from tests/ui to e2e/ui.
• Add a small app Vitest boundary around HTML extraction.
• Remove next/font/google from the app shell so public CI builds do not depend on external Google font downloads.
• Update README and AGENTS docs to use pnpm -F @html-anything/next ... and pnpm -F @html-anything/e2e ....

Why

This establishes the minimal public harness boundary before large feature branches such as export-target work rebase onto main. The goal is to make directory shape, app tests, browser smoke, and CI expectations explicit without requiring secrets.

Validation

• pnpm install --frozen-lockfile
• pnpm exec tsx scripts/guard.ts
• pnpm -F @html-anything/next typecheck
• pnpm -F @html-anything/e2e typecheck
• pnpm -F @html-anything/next test
• pnpm -F @html-anything/next build
• pnpm -F @html-anything/e2e test
• git diff --check

pnpm -F @html-anything/next build still emits the existing Turbopack NFT tracing warning through next/src/lib/agents/invoke.ts, but the build exits successfully.