ci: add cargo fmt/clippy/test workflow with test-modification detector

[RagingRedRiot]

Background

There's been no automated check on the repo until now — every PR has been validated by running cargo test locally. With the repo public and branch protection requiring PRs to main, the lack of a green-check signal on the PR view is the next gap worth closing.

What this adds

A single .github/workflows/ci.yml triggered on pull_request to main (and on push to main), with four jobs running in parallel:

Job	What it runs	Notes
fmt	cargo fmt --all --check	No service container, no cache — finishes in seconds
clippy	cargo clippy --all-targets --locked -- -D warnings	Lints lib + bin + tests; treats every warning as an error
test	cargo test --locked against a Postgres 18 service container	sqlx::test provisions per-test DBs and runs migrations automatically; PG18 is required because the schema uses the built-in uuidv7() function
detect-test-modifications	Diffs tests/ against the PR base; surfaces edits to existing test code as a self-updating PR comment	See next section

cargo jobs share a Swatinem/rust-cache cache; the fmt job skips caching since it doesn't compile.

Why the test-modification check is informational, not blocking

Adding new tests is always welcome and never triggers the detector: --diff-filter=MDR excludes pure additions, so a new tests/rooms.rs or a new #[sqlx::test] appended to an existing file produces no notice.

The detector exists for the quiet failure mode: a PR that removes or weakens assertions inside an existing test, or that edits a helper under tests/common/ that other tests transitively depend on. Both are sometimes legitimate (a test needs to evolve with the behavior it's measuring) but they should never slip past review unnoticed.

The detector posts a PR comment listing the affected files and line counts, keyed by an HTML marker so subsequent pushes update the same comment in place. If a follow-up push rolls the test changes back, the comment is deleted. The job itself always exits 0 — it's a reviewer aid, not a gate.

Test plan

• cargo fmt --all --check clean against current main
• cargo clippy --all-targets --locked -- -D warnings clean locally
• This PR exercises the workflow against itself (workflow lives on the head branch, so all four jobs run on this PR)
• fmt, clippy, and test jobs all green on this PR
• detect-test-modifications reports ✓ (this PR touches no files under tests/)
• Smoke-test the detector after merge by opening a throwaway PR that removes a line from an existing test, confirming the comment shows up; then pushing a follow-up that restores the line and confirming the comment is deleted (test: smoke-test the test-modification detector (do not merge) #4)