ci: add test/build/lint CI workflow

[kud]

Summary

• Adds a CI workflow (.github/workflows/ci.yml) that runs the project's quality gates — build, test, lint — on every pull request and on push to main.
• Previously the repo had no non-release CI, so a broken build or failing test could land unnoticed on main.
• Conventions matched to the existing release.yml: actions/checkout@v6, actions/setup-node@v6, Node 24, npm ci (the lockfile is committed, so cache: npm is safe to enable).

Test plan

• npm ci — installs clean
• npm run build (tsup) — passes
• npm run test (vitest, 66 tests / 11 files) — passes
• npm run lint (eslint) — passes (0 errors, pre-existing no-explicit-any warnings only)
• Confirm the new workflow goes green on this PR's own CI run