ci: validate pull request builds

[Jah-yee]

Summary

• add a read-only CI workflow for pull requests and manual runs
• build the same universal app bundle as the release workflow with ./build.sh --universal
• verify arm64 and x86_64 slices for both Mac Duo and lidprobe
• validate the bundle plist, ad-hoc signature, and packaged license files
• pin the checkout action to its immutable v4 commit and rely on the runner's default Xcode

Why

The release workflow only runs after changes reach main, so contributions currently receive no build or packaging signal before merge. This workflow uses contents: read, does not receive release secrets, cancels superseded runs, and has a 15-minute timeout. It also prints the selected Xcode and Swift versions without adding a third-party toolchain-selection action.

Validation

• completed a local universal build
• verified both architectures in the app and probe binaries
• validated the plist, signature, LICENSE, and NOTICE checks
• verified the pinned checkout SHA resolves to the official actions/checkout v4 ref
• checked the workflow YAML and ran git diff --check

The x86_64 validation proves that the Intel slices compile and link; it is not an Intel runtime test.

Bootstrap note

The current fork run is marked action_required with no jobs because GitHub requires maintainer approval before running a first-time contributor's workflow. Once this workflow is on the default branch, later pull requests can receive the build signal normally.

[Jah-yee]

Closing per Gate-2 (max 2 concurrent PRs per repo). Keeping #16 and #17 as the primary clean PRs.