Run packages/* tests in CI (auth, schema, llm)

[ckrough]

Follow-up from #93 (shared gateway client package), promised in PR #321.

No CI job runs the test suites under packages/*. paths-filter fans a packages/** change out to the retriever and petdata jobs, but those run with working-directory: services/<svc> and invoke only that service's pytest, so a package's own tests are never collected.

Concretely, the 6 tests in packages/llm/tests/test_gateway_client.py moved there in #93 and now run in no CI job. packages/auth and packages/schema have the same gap; #93 did not create it, it added a third package to it.

Consumers exercise the packages transitively (retriever's suite imports evermore_llm), so a break in the shared code still fails CI somewhere. What is missing is direct coverage: a package-only regression that no current consumer happens to hit passes CI silently.

• Add a packages job to .github/workflows/ci.yml, gated on the existing packages/** paths-filter output.
• Run each package's own gates: ruff check, ruff format --check, mypy src/, pytest (matrix over auth, schema, llm rather than three jobs).
• Add the job to the ci-success needs list so it is required, not advisory.

Acceptance Criteria

• A packages/**-only change runs the affected package's own test suite in CI.
• Deleting an assertion in packages/llm/tests/test_gateway_client.py fails CI.
• ci-success fails when the packages job fails.