ci: run tests and typecheck on pull requests

[andrei-hasna]

Summary

• add a CI workflow for pull requests and pushes to main
• install dependencies from the frozen Bun lockfile, then typecheck and run the full test suite
• document the new gate in the changelog

Verification

• bun install --frozen-lockfile
• bun run typecheck
• bun test (39 passed across all 7 test files)

All existing suites are included; no external services or credentials are required.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}