ci: run checks and tests on every pull request

[thymikee]

Adds .github/workflows/ci.yml. It runs npm ci, npm run check and npm test on every pull request (any base branch) and on pushes to main.

• Runs on: one Linux job with the latest Node.js.
• Settings:
  • Caches npm.
  • Cancels older runs on the same branch.
  • Read-only contents permission.
  • Actions are pinned to full commit SHAs, with the release tag in a comment.

CONTRIBUTING.md now says what CI runs.

To block merging on red checks, mark the test job as required in the branch protection settings for main.