ci: run lint/knip verification on push to main and release branches

Add a verify-only post-merge gate so lint/format/knip failures that
accumulate via merge skew are caught on the branch instead of ambushing
backports. PR and merge_group checks only evaluate a single PR's diff, so
no existing check ever evaluates the branch state as a whole.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/ci-lint-format-push.yaml

@@ -0,0 +1,36 @@
+# Description: Lint and format verification for push to the default and
+# release branches. This is a post-merge authoritative gate: PR and
+# merge_group checks only evaluate a single PR's diff, so merge skew can
+# accumulate failures (e.g. unused exports) on the branch that no single
+# check ever evaluates together. This file runs verify-only steps with a
+# read-only token; auto-fix and PR comments live in the PR workflow. Its
+# name is intentionally distinct from 'CI: Lint Format' so it does not
+# collide with the branch-protection required-check name.
+name: 'CI: Lint Format (push)'
+
+on:
+  push:
+    branches:
+      - main
+      - 'cloud/**'
+      - 'core/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  lint-and-format:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout push ref
+        uses: actions/checkout@v6
+
+      - name: Setup frontend
+        uses: ./.github/actions/setup-frontend
+
+      - name: Verify lint and format
+        uses: ./.github/actions/lint-format-verify