Add CI badges and CI/CD section to README

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -1,5 +1,9 @@
 # GANDALF (Global Advanced Network Detection And Link Facilitator)
 
+[![Lint](https://code.lotusguild.org/LotusGuild/gandalf/actions/workflows/lint.yml/badge.svg)](https://code.lotusguild.org/LotusGuild/gandalf/actions?workflow=lint.yml)
+[![Test](https://code.lotusguild.org/LotusGuild/gandalf/actions/workflows/test.yml/badge.svg)](https://code.lotusguild.org/LotusGuild/gandalf/actions?workflow=test.yml)
+[![Security](https://code.lotusguild.org/LotusGuild/gandalf/actions/workflows/security.yml/badge.svg)](https://code.lotusguild.org/LotusGuild/gandalf/actions?workflow=security.yml)
+
 > Because it shall not let problems pass.
 
 Network monitoring dashboard for the LotusGuild Proxmox cluster.
@@ -486,3 +490,20 @@ under `unifi_switches.<switch_name>.model`), then add to `SWITCH_LAYOUTS` in
 - SSH collection via Pulse is synchronous — if Pulse is slow, the entire monitor cycle
   is delayed. The `pulse.timeout` config controls the max wait.
 - UniFi LLDP data is only as fresh as the last monitor poll (120s default).
+
+---
+
+## CI / CD
+
+| Workflow | Purpose | Triggers |
+|---|---|---|
+| `lint.yml` (python-lint) | flake8 on all `.py` files | Every push and PR |
+| `lint.yml` (js-lint) | ESLint on `static/` | Every push and PR |
+| `test.yml` | pytest — 33 tests for `diagnose.py` static methods | Every push and PR |
+| `security.yml` | bandit `-ll` (medium+ severity) | Every push, PR, and weekly Monday 6am |
+| `deploy` job in `lint.yml` | Calls the `gandalf-deploy` webhook on CT157 (10.10.10.61) | Push to `main` only, after both lint jobs pass |
+
+Branch protection is enabled on `main` — both lint jobs must pass before any PR can merge.
+
+Tests live in `tests/test_diagnose.py` and cover `DiagnosticsRunner` static methods:
+`build_ssh_command`, `parse_output`, `parse_sysfs_stats`, `parse_ethtool`, and variants.