ci: gate pull requests on typecheck and tests

[andrei-hasna]

Summary

• add a one-job GitHub Actions workflow for pull requests and pushes to main
• install with Bun using the frozen-lockfile flag, then run typecheck and all tests
• replace two leaking process-wide Bun module mocks with hermetic adapters so the complete suite is green in one process
• document the CI gate in the changelog

Verification

• bun install --frozen-lockfile
• bun run typecheck
• bun test — 248 passed, 0 failed

No suites were excluded. The clean full-suite baseline had two order-dependent failures because test-only module mocks leaked into later HTTP and server integration tests; those tests already passed individually. The PR removes that cross-file contamination instead of skipping tests or allowing failures.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}