Problem

vyconf's .github/workflows/ currently contains only governance workflows (CLA check, PR mirror, LTS-name advisory, mergify title-lint). Nothing compiles or tests the code on a PR — a broken dune build or failing dune runtest can merge undetected.

Secondary: vyconf.opam is missing vyos1x-config from depends: even though every src/dune library stanza links it, so a clean opam install cannot resolve the dependency solve.

Change

• New .github/workflows/build.yml: ocaml/setup-ocaml@v3 matrix (OCaml 4.14 + 5.2) → pin vyos1x-config from git (#rolling, not on the default opam repo) → opam install . --deps-only --with-test → dune build → dune runtest. Triggers on push + PR to rolling. permissions: contents: read, pull_request (not _target), concurrency-cancel.
• vyconf.opam: add vyos1x-config + yojson to depends: (both referenced directly in src/dune); remove the duplicate toml entry.

Scope note

CI-enablement tier only. Other findings from the codebase audit (handler Not_found escape, commit-lock never wired, commitd fd leak, path-confinement on load/save, near-zero test coverage of core session ops, README OASIS drift) are follow-ups, tracked separately.

Verification

The PR's own CI run is the verification oracle (build/test cannot run in the authoring environment).