test: check context.workflowRunCreatedAt in every ci route function

[CahidArda]

Stacked on #214. The base is feat/workflow-created-at-dedup; once #214 is merged, retarget this to main. The diff here is only the CI check.

Why

#214 makes every request of a workflow run carry Upstash-Workflow-CreatedAt. QStash uses it to tell apart runs started with the same workflow run id and the same data. The SDK reads it from the incoming request into context.workflowRunCreatedAt and sends it with everything the run publishes. So if a request ever reaches a route function without it, that run is back to being deduplicated against earlier runs with the same id. This PR makes the CI app fail when that happens.

What changed

• expectWorkflowRunCreatedAt(context) (examples/ci/app/ci/utils.ts) throws unless context.workflowRunCreatedAt is a positive finite number. It's covered in ci/utils.test.ts (0, -1, NaN, undefined and a numeric string all throw).
• It's called as the first line of every route function in the CI app: 47 of them, across serve, serveMany/createWorkflow, invoked and invoker workflows, and the same-run-id target and child from feat: send Upstash-Workflow-CreatedAt so runs with the same id aren't deduplicated #214. Route functions run from the top on every request, so this runs before the first step, in every invocation: steps, waits and their timeouts, context.call results, invoke results, webhook resumes, and the authorization dry run of first invocations.
• auth/custom/target is left out, with a comment. It isn't a real workflow; it only receives the forged requests of auth/custom/workflow to check that they're rejected, and one of them is a fake failure callback without a creation time.

Why it holds today

• Every CI run is created by QStash (client.trigger, /v2/trigger, invoke), and QStash already sends Upstash-Workflow-CreatedAt with every request it delivers for a run (deliver.go). This doesn't depend on qstash-server#1129 being deployed.
• wait-for-event/notifier-workflow is started through context.call, which is a direct first invocation with no header. It passes because of the serve change in feat: send Upstash-Workflow-CreatedAt so runs with the same id aren't deduplicated #214: a first invocation that doesn't come from QStash gets the trigger time as its creation time, and the trigger sends that same value.

Checks

• tsc -p examples/ci against a local build of feat: send Upstash-Workflow-CreatedAt so runs with the same id aren't deduplicated #214 passes.
• ci/utils.test.ts: 5 passed.
• The integration job deploys a build published from this branch, so it runs with feat: send Upstash-Workflow-CreatedAt so runs with the same id aren't deduplicated #214's SDK changes.

🤖 Generated with Claude Code

https://claude.ai/code/session_017dm7F4hg2khgYDqBwP9nx5