ci: run CI on pushes to v3

[Kamirus]

Pushing to v3 ran no checks at all. ci.yml, cli-bundle.yml and mops-test.yml trigger on pushes to main/master and on pull_request, so a merge into the integration branch was validated only by whichever PR happened to be based on it next — and when something breaks that way, the failure surfaces on an unrelated PR and is awkward to attribute to the merge that caused it.

Adding v3 to all three workflows behind the required checks rather than to ci.yml alone: ci-ok, ci-ok-cli and ci-ok-mops come from three separate files, so touching one would leave two of the three required checks unrun on a v3 push. code-quality.yml is included for parity — it already runs on main pushes and is cheap.

This matters more now that admin bypass is disabled on both branches: everything reaches v3 through a PR, and the post-merge state of the branch should be verified in its own right rather than inferred.

No behavior change for PRs — those already ran on pull_request regardless of target branch.

[github-actions]

Cursor AI review

👍 APPROVE — looks safe to merge

Category	Assessment	Details
Summary	✅	Adds v3 to the push.branches filter in ci.yml, cli-bundle.yml, mops-test.yml, and code-quality.yml so post-merge pushes to the integration branch run the same checks as main/master.
Code Quality	✅	Four one-line additions; scoped to the workflows that emit required ci-ok* jobs plus code-quality for parity — no speculative workflow churn.
Consistency	✅	Same branch list pattern as existing main/master entries in all four files; pull_request triggers untouched. Confirmed ci-ok / ci-ok-cli / ci-ok-mops live in the three updated required-check workflows.
Security	✅	Diff only extends push.branches; permissions: contents: read unchanged in ci/cli-bundle/mops-test; no pull_request_target, secrets, or action-pin changes. release.yml / deploy paths not touched.
Tests	✅	CI/YAML-only; no app code. Behavior verified from patches vs Head workflow on: blocks — push to v3 now matches main/master; PR runs already covered by existing pull_request.
Maintainability	✅	Minimal, obvious trigger update; keeps required-check coverage aligned across the three workflow files that define them.

Verdict

Decision: APPROVE
Risk: Very Low
Reason: Additive CI trigger for an existing branch with no permission, secret, or deploy-pipeline changes; PR event behavior is unchanged.

---

Generated for commit 3b30b5b

[automation-sa-sre]

Automated approval: the AI review verdict for 3b30b5b is APPROVE. See the "Cursor AI review" comment for details.