Runtime hardening, CI workflows, and quality gate fixes

.github/workflows/pr-checks.yml

@@ -0,0 +1,71 @@
+name: PR Checks
+
+on:
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: pr-checks-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    env:
+      CARGO_NET_OFFLINE: "false"
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y pkg-config libssl-dev
+
+      - name: Install cargo-make
+        uses: davidB/rust-cargo-make@v1
+
+      - name: Install cargo-nextest
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-nextest
+
+      - name: Install cargo-audit
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-audit
+
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-deny
+
+      - name: Audit Dependencies
+        run: cargo make audit
+
+      - name: Deny Check
+        run: cargo make deny
+
+      - name: Run Tests
+        run: cargo make test
+
+      - name: Lint
+        run: cargo make clippy
+
+      - name: Format Check
+        run: cargo make format-check
+
+      - name: Architecture Guardrails (if configured)
+        shell: bash
+        run: |
+          if [[ -f scripts/check_architecture.sh ]]; then
+            cargo make architecture-check
+          else
+            echo "Skipping architecture-check: scripts/check_architecture.sh not found."
+          fi
+
+      - name: Verify Publish Readiness
+        run: cargo publish --dry-run --locked