Add CI gate for pull requests

[JacobAtchley]

Summary

• Adds .github/workflows/ci.yml. It runs on pull requests into main and on pushes to main, on both ubuntu-latest and macos-latest.
  • Checks, in order: cargo fmt --all --check, then cargo clippy --workspace --all-targets -- -D warnings, then cargo test --workspace.
  • A newer push to the same PR cancels the run still going on the older commit.
• Adds a just ci recipe that runs the same three checks locally.
• Adds a README note about the gate.

After this PR's checks pass, a main ruleset will be added. It will require a PR, require test (ubuntu-latest) and test (macos-latest) to pass, and require the branch to be up to date with main. The repo admin can bypass it.

Test plan

• just ci passes locally
• Both CI jobs pass on this PR

🤖 Generated with Claude Code