ci: add GitHub Actions CI workflow

[bkearns]

Executive Summary

Adds a CI workflow so main can require green checks before merge. Runs on every PR into main.

Checks (checks job)

• pre-commit (--all-files) — ruff, ruff-format, bandit, detect-secrets (baseline), shfmt, codespell, hygiene.
• Python compile — compileall over hooks/ and plugin/.
• Installer dry-run (hermetic) — stubs the ferrosa-memory turn-hook helper (which ships with ferrosa-memory, not this repo) so the existence check passes, and writes wrappers to $RUNNER_TEMP so nothing outside the workspace is touched. Exercises arg parsing, wrapper/snippet generation, and the manifest.

Notes

• PR-only (on: pull_request): pre-commit's no-commit-to-branch hook fails on main by design, so CI gates at the PR rather than on push to main.
• After this merges, I'll add the checks context as a required status check on main's branch protection.

Test Plan

• CI checks job is green on this PR
• checks then added as a required status check on main