feat(verticals): Workday (@hanzo/workday) — HR/HCM

Workday OAuth2 (HTTP Basic client auth, non-rotating refresh) + REST (staffing/
recruiting/absence) + RaaS custom reports, AI actions (summarize worker/team/org,
draft requisition); read-only proxy (405 on writes). 113 tests. On published
@hanzo/ai@0.2.0. CI step added.

.github/workflows/ci.yml

@@ -105,6 +105,9 @@ jobs:
     - name: Test Canvas LMS (education)
       run: pnpm --filter @hanzo/canvas-lms test
 
+    - name: Test Workday (HR)
+      run: pnpm --filter @hanzo/workday test
+
     - name: Test cards (shared card-builder)
       run: pnpm --filter @hanzo/cards test
 

pnpm-lock.yaml

@@ -1141,6 +1141,28 @@ importers:
         specifier: ^3.2.6
         version: 3.2.6(@types/node@16.18.126)(jsdom@26.1.0)(sass@1.60.0)(terser@5.43.1)
 
+  packages/workday:
+    dependencies:
+      '@hanzo/ai':
+        specifier: ^0.2.0
+        version: 0.2.0
+      '@hanzo/iam':
+        specifier: ^0.13.2
+        version: 0.13.2(react@19.2.7)
+    devDependencies:
+      '@types/node':
+        specifier: ^20.14.0
+        version: 20.19.9
+      esbuild:
+        specifier: ^0.25.8
+        version: 0.25.8
+      typescript:
+        specifier: ^5.8.3
+        version: 5.8.3
+      vitest:
+        specifier: ^3.2.6
+        version: 3.2.6(@types/node@20.19.9)(jsdom@26.1.0)(sass@1.60.0)(terser@5.43.1)
+
   packages/zendesk:
     dependencies:
       '@hanzo/ai':