14.0.0 (initial NCI release)

(#3) Add PHPCS and PHPUnit to CI workflow

Wires the placeholder CI workflow up with real checks now that it's
registered on main and can actually be exercised from a branch:

- PHPCS: no new setup needed, phpcs.xml.dist already defines the
  AcquiaDrupalStrict ruleset. Verified clean (0 errors/warnings, 120
  files) against current main.
- PHPUnit: phpunit/phpunit was never a dependency despite tests/phpunit
  existing, so it couldn't be run at all. Added ^9.6 and scoped the CI
  step to tests/phpunit/Robo only. tests/phpunit/src extends
  BltProjectTestBase, which spins up a full sandboxed BLT project per
  test (git init, composer install) -- that needs its own CI setup and
  a deliberate decision, not a blind phpunit run against all of tests/.
  Verified 8/8 passing.
- Bumped squizlabs/php_codesniffer 3.10.1 -> 3.13.6 (composer audit
  flagged a high-severity OS command injection advisory on <3.13.6;
  already-permitted by the existing ^3.6 constraint).
- Consolidated phpcs and phpunit into a single job. Both need the
  identical environment and dependencies, so running checkout/setup-php/
  cache/install twice across two jobs was pure duplication. PHPUnit step
  keeps if: success() or failure() so it still runs and reports even if
  PHPCS fails first.
- Composer cache path resolved dynamically via composer config
  cache-files-dir (matching CGDP's own ci.yml and setup-php's
  recommended pattern) instead of a hardcoded path, which was wrong on
  modern composer and silently missing cache every run. Cache keys
  prefixed with runner.os per actions/cache's own PHP/Composer example.
- actions/checkout pinned to v7, actions/cache to v6.
  shivammathur/setup-php pinned to the exact commit its v2 tag currently
  resolves to (third-party action, so pinned by SHA rather than a
  floating tag per security review).

phpstan intentionally left out of this workflow: no existing config,
no baseline, and turning it on blind risks burying the two real checks
under hundreds of unreviewed findings. Follow-up ticket territory.

Verified locally: phpcs 0 errors/warnings across 120 files, phpunit
8/8 passing.

Closes #3