ci: verify pull requests into main

[malinfossum]

Adds .github/workflows/ci.yml — a single verify job that runs on every pull request into main.

Why

deploy.yml only runs on: push: [main], so the protect-main ruleset's Require status checks to pass rule had nothing to require. A PR could not be blocked on a red build. This gives it something to require.

Shape

Decision	Reason
One job, not four	The ruleset then has a single check to require, instead of four that each have to be enabled and kept in sync.
check → test:run → build	Cheapest first. A formatting failure reports in seconds rather than after the suite and the build.
No push: [main] trigger	deploy.yml already runs test:run + build there; duplicating it wastes minutes.
cancel-in-progress: true	A new push to the same PR makes the previous run irrelevant. deploy.yml deliberately does the opposite — a half-finished deploy is worse than a slow one.
permissions: contents: read	Nothing here writes.

Node 22 + cache: npm, matching deploy.yml.

Verification

This PR is its own test: pull_request workflows run from the PR branch, so a green verify check here means the file parses and every step passes on a clean runner.

Locally on this branch: npm run check clean (57 files), 210/210 tests, npm run build clean.

Follow-up (needs you, in GitHub settings)

Once this merges and one PR has reported a green verify, enable Require status checks to pass on the protect-main ruleset and select verify. GitHub only offers checks it has seen run at least once.