ci: run quality gate on pull requests

[andrei-hasna]

Summary

• add a single CI job for pull requests and pushes to main
• install dependencies from the frozen Bun lockfile
• require typecheck, build, and the complete test suite to pass

No test suites are excluded; all 7 test files run hermetically.

Verification

• bun install --frozen-lockfile
• bun run typecheck
• bun run build
• bun test (44 passed, 0 failed)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}