sync: mirror deployed github repo (chains + sanitized bridge), keep GitLab CI

Make this monorepo's tracked tree identical to the deployed github repo
(github.com/pezkuwichain/pezkuwi-DKS): all RC/AH/People runtimes and framework
carry the mainnet fixes (incl. U128CurrencyToVote everywhere, so the staking
election stall cannot recur), and tools/usdt-bridge matches the current,
public-safe custody tooling (real config/deploy units gitignored, secret-file
locations and server IPs stripped, sanitized *.example templates committed).

Only exception to the mirror: GitLab-native CI is preserved (.gitlab-ci.yml and
.gitlab/), to be rebuilt to match the github CI pipeline in a follow-up.

.github/workflows/check.yml

@@ -0,0 +1,84 @@
+name: check
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_INCREMENTAL: "0"
+
+jobs:
+  # Compliance is cheap and must always hold.
+  compliance:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Ensure license & attribution files present
+        run: |
+          set -e
+          test -f NOTICE
+          test -f LICENSE-APACHE
+          test -f LICENSE-GPL3
+          echo "compliance files present"
+
+  fmt:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: rustfmt
+        run: |
+          rustup component add rustfmt
+          cargo fmt --all --check
+
+  # Build the runtimes (the on-chain deliverable). This is the gating job.
+  # Heavy zombienet / emulated integration suites are intentionally NOT run here;
+  # they are available in-tree and run on demand, not on every push.
+  runtimes:
+    # Self-hosted runner (dedicated, isolated box). For security on a public repo,
+    # this heavy job runs ONLY on push to a branch in this repo or on PRs that
+    # originate from this repo — never on pull requests from forks, so untrusted
+    # code cannot execute on the runner.
+    if: >-
+      github.event_name == 'push' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: [self-hosted, substrate-build]
+    steps:
+      - uses: actions/checkout@v7
+      - name: Toolchain & targets
+        run: |
+          rustup show
+          rustup component add rust-src
+          rustup target add wasm32v1-none wasm32-unknown-unknown
+      - name: Build runtime WASM (check)
+        run: |
+          cargo check --locked \
+            -p pezkuwichain-runtime \
+            -p zagros-runtime \
+            -p asset-hub-pezkuwichain-runtime \
+            -p asset-hub-zagros-runtime \
+            -p people-pezkuwichain-runtime \
+            -p people-zagros-runtime
+
+  # The runtimes must also build with the try-runtime feature — this is what makes
+  # safe storage migrations possible, a fund-critical gate before any upgrade. It is
+  # light (-p runtimes only), so it stays on the every-push fast path. The heavy
+  # full-workspace suites (tests, clippy, benches, doc-tests) run nightly in test.yml.
+  check-try-runtime:
+    if: >-
+      github.event_name == 'push' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: [self-hosted, substrate-build]
+    steps:
+      - uses: actions/checkout@v7
+      - run: |
+          cargo check --locked --features try-runtime \
+            -p pezkuwichain-runtime -p zagros-runtime \
+            -p asset-hub-pezkuwichain-runtime -p asset-hub-zagros-runtime \
+            -p people-pezkuwichain-runtime -p people-zagros-runtime