ci: add pull request quality gate

[andrei-hasna]

Summary

• run CI on every pull request and push to main
• install dependencies from the lockfile, then typecheck, build, and run the full test suite
• pin checkout and Bun setup actions to major version tags

Verification

• bun install --frozen-lockfile
• bun run typecheck
• bun run build
• bun test (221 passed, 0 failed)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}