ci: run checks on pull requests

[andrei-hasna]

Summary

• add one GitHub Actions job for pull requests and pushes to main
• run frozen Bun install, typecheck, build, and the full test suite
• install lsof, which the process-tree tests require
• document the new CI gate in the changelog

No test suites are excluded.

Verification

• bun install --frozen-lockfile
• bun run typecheck
• bun run build
• bun test (278 passed, 0 failed)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}