ci: run tests on pull requests

[dangzitou]

Summary

• Run the existing npm test checks on pull requests with Node.js 18 and 24.
• Install ripgrep, which the MCP search test requires.
• Limit the workflow token to read-only access and avoid persisting checkout credentials.

Validation

• npm test passed locally.
• Parsed the workflow YAML and checked its trigger, matrix, and test command.