Add internal CI: task unit tests and Bolt plan smoke test

[silug]

Closes #54

Adds CI for puppetsync itself, written for what this repo actually is (a Bolt project), not derived from the downstream pupmod baseline.

What's in it

spec/ — plain rspec, no bundle needed (rspec from the repo root):

• spec/tasks/git_commit_spec.rb — runs the task as a standalone script against throwaway git repos: commits pending changes, amends when the (multi-line) message matches, exits cleanly on a no-change repo, fails on missing params. This pins down current behavior ahead of the Full idempotency: repos that need no changes must pass through cleanly #49 idempotency work.
• spec/tasks/configure_renovate_spec.rb — preset injection, extends preservation, Gemfile rewriting with the renovate manager comment, JSON5 rejection, and a full idempotency check (two runs produce identical output).
• spec/project_files_spec.rb — ruby -c over every task script, JSON validity of every task metadata file, YAML validity of every file under data/ plus bolt-project.yaml/hiera.yaml/inventory.yaml, and a check that the latest.yaml symlinks resolve.

.github/workflows/ci.yml — two jobs:

• spec: rspec on Ruby 3.2 (matching openbolt's bundled Ruby).
• bolt: installs openbolt from the Vox Pupuli openvox8 apt repo (matching the OpenVox migration direction), runs the documented ./Rakefile install path (so gem.deps.rb/module breakage is caught), validates Puppet syntax (--tasks mode for plans, normal mode for classes/functions), then smoke-tests bolt plan show puppetsync and a list_pipeline_stages dry run with dummy tokens.

All of it verified locally before pushing: 139 examples / 0 failures, both parser-validate invocations clean, both bolt smoke tests green, and ./Rakefile install works end-to-end against openbolt 5.6.0.

Relationship to #24

Per the discussion about splitting #24 into puppetsync-internal files vs. puppetsync-managed files: this workflow is deliberately named ci.yml and carries no "managed by puppetsync" header, so it stays clearly on the internal side. #24 can drop its template-derived pr_tests.yml and keep the rubocop/lint cleanup; once #24's .rubocop.yml lands, a rubocop job can be added to this workflow as a follow-up (kept out of this PR to avoid entangling the two).

Notes / out of scope

• dist/puppetsync/spec/functions/parse_puppetfile_spec.rb tests a function that no longer exists (puppetsync::parse_puppetfile) and needs the full rspec-puppet stack; it's untouched here and worth removing or reviving separately.
• The amend-detection quirk in git_commit.rb (never fires for single-line messages because git log -1 --pretty=%B keeps a trailing newline) is documented by the new specs' use of multi-line messages; fixing it belongs with Full idempotency: repos that need no changes must pass through cleanly #49.

🤖 Generated with Claude Code