[momchilov]

• CI (.github/workflows/check.yml): cargo test --workspace for kestreld, nft-resolve and social-firewall (one job each), plus shellcheck -S error on the shell scripts. It runs on pushes to main and rust-rewrite and on every pull request. The QEMU tests stay manual, as CONTRIBUTING.md describes.
• Dependabot keeps the Actions versions current (monthly).
• README: check, MIT and #lanbat badges, plus links to the kestrel tour and the LAN BAT hub.

Expected first result: test networks/kestreld-rs fails. src/lib.rs on rust-rewrite declares mod auth and mod mqtt, but auth.rs and mqtt.rs (and migrations 0004–0006) aren't committed yet. It turns green once they're pushed. Locally, nft-resolve (156 tests) and social-firewall (348 tests) pass.

cargo fmt --check is left out for now: all three workspaces need a formatting pass first.

🤖 Generated with Claude Code