Remove ci.yml (pull_request_target with unprotected environment)

[visch]

Security fix: remove pull_request_target workflow

ci.yml triggers on pull_request_target and uses the authorize/environment gate to protect a test job holding 6 Google Ads OAuth secrets. But the external environment has no required_reviewers (unlike the correctly-configured tap-bls), so the gate is a no-op.

Not currently exploitable (no PR-head checkout → runs trusted base code), but it's a footgun: adding ref: head.sha to 'actually test PRs' would turn it into full secret exfiltration.

Per maintainer decision, removing the workflow entirely to eliminate the attack surface. Note: this drops all CI on the repo (build matrix + secret test); a push-only CI can be added back later if desired.

🤖 Generated with Claude Code

---

Note

Medium Risk
Removes the repository’s GitHub Actions CI pipeline, which reduces security exposure but also eliminates automated build/test coverage on pushes and PRs.

Overview
Removes the GitHub Actions workflow ci.yml, eliminating the build matrix and the secret-backed test job that previously ran under pull_request_target with an environment gate.

As a result, this PR drops all automated CI from the repository (no build or tox test runs via GitHub Actions).

^{Reviewed by Cursor Bugbot for commit 9d6a3e9. Bugbot is set up for automated code reviews on this repo. Configure here.}