Set up GitHub Actions CI

[Dannyswiss1]

Automated checks on every PR so broken code can't merge silently.

Acceptance Criteria

• Workflow runs lint, typecheck, unit tests, and build on every PR
• Status checks required before merge (documented for maintainers to enable branch protection)

Part of epic #9