ci: add GitHub Actions workflow (ruff, mypy, pytest, evals, tsc)

[AshwinUgale]

Adds .github/workflows/ci.yml running on push to main and on PRs, so branch protection can require a status check. Two jobs mirror scripts/check.ps1:

• sidecar (Python 3.11 + 3.12): uv sync, ruff check, ruff format --check, mypy strict, pytest, plus the evals suite via PYTHONPATH.
• extension (Node 20): npm ci, tsc --noEmit.

CI is hermetic and keyless: OpenAI/Qdrant are mocked in tests, so a placeholder OPENAI_API_KEY only satisfies the entrypoint's presence guard, and the live_subprocess tests (which reach for a real Qdrant) are deselected.

Also fixes issues the strict CI surfaced that the local --fix pipeline had been masking:

• test_ws_auth.py: combine nested with-statements (ruff SIM117)
• main.py, agent.py: apply ruff formatter (format --check)
• uv.lock: relock stale package version (1.0.0 -> 1.0.2)

What & why

Checklist

• ./scripts/check.ps1 passes (sidecar: ruff + mypy strict + pytest; extension: tsc),
  or the equivalent per-stack commands
• new behavior has a test (sidecar) and/or an eval case
• no secrets committed; .env stays local
• CHANGELOG.md updated (for user-visible changes)
• I read CONTRIBUTING.md

Notes