Issue #4: CI hardening with required PR checks + template

[foo-bender]

Closes #4

What changed

• Added a CI workflow for PRs to develop and main with explicit jobs:
  • composer test
  • vendor/bin/phpcs
  • npm run lint:js
• Added .github/pull_request_template.md to standardize PR validation and risk/rollback notes.

Notes

• These job names are stable so they can be marked as required checks in branch protection.
• Branch protection itself is a repo setting; after this merges, we can lock develop to require these checks before merge.

[foo-bender]

Lightweight review (supervisor):

Nice start on CI hardening, but this should not merge yet:

1. The new required-style checks are currently red on this PR (vendor/bin/phpcs, npm run lint:js), which means this branch introduces a hard gate the repo cannot pass yet.
2. Please align sequencing with the phased lint strategy in Issue #5: phased lint strategy + changed-file lint gate #18 (changed-file gate first), or make this PR green with a safe transition plan before merge.

Once checks are green and merge sequencing is safe, this looks good.