ci: add focused pull request validation

[squarepots]

本 PR 为 pull request 增加只读验证 workflow，避免回归等到 release workflow 才发现。

• Ubuntu frontend job 使用 frozen lockfile，运行 pnpm build 和聚合的 pnpm test。
• pnpm test 使用 Node 内置 test runner 的 tests/*.test.* 发现约定，覆盖 .test.ts 和 .test.mjs，因此 browser-runtime、web-boundary、backup-passphrase、warmup-policy、release-source 等 focused suite 合并进来后无需再维护手写列表。
• Ubuntu Rust job 安装 Tauri Linux 编译依赖，检查本 PR 修改的 Rust 文件格式，并运行 cargo test --locked。
• macOS 与 Windows 各运行 cargo check --locked，覆盖 platform-gated Tauri/Rust 路径。
• workflow 使用 pull_request、同一 PR 的旧运行会被取消，并且只授予 contents: read；不包含 release、签名或发布权限。

验证

• pnpm install --frozen-lockfile：通过
• pnpm test：当前 checkout 的 13 项通过；聚合命令按文件名发现后续 focused suite
• pnpm build：通过
• cargo test --locked --manifest-path src-tauri/Cargo.toml：50 项通过
• cargo check --locked --manifest-path src-tauri/Cargo.toml：通过
• git diff --check：通过

GitHub 已识别该 workflow；当前 fork PR 的远程运行在 job 启动前处于 action_required，需要仓库维护者批准 public-fork workflow 后才会产生 CI 结果。

Closes #164

---

This PR adds read-only pull-request validation so regressions are caught before the release workflow.

• The Ubuntu frontend job installs from the frozen lockfile and runs pnpm build plus the aggregate pnpm test command.
• pnpm test uses Node’s built-in test runner with the tests/*.test.* filename convention, covering both .test.ts and .test.mjs. The browser-runtime, web-boundary, backup-passphrase, warmup-policy, and release-source focused suites will therefore be included when their existing PR branches are combined without another hand-maintained list.
• The Ubuntu Rust job installs the Tauri Linux build dependencies, checks formatting for Rust files changed by the PR, and runs cargo test --locked.
• macOS and Windows each run cargo check --locked to cover platform-gated Tauri/Rust paths.
• The workflow uses pull_request, cancels older runs for the same PR, and grants only contents: read; it has no release, signing, or publishing permissions.

Validation

• pnpm install --frozen-lockfile: passed
• pnpm test: 13 current-checkout tests passed; the aggregate discovers later focused suites by filename
• pnpm build: passed
• cargo test --locked --manifest-path src-tauri/Cargo.toml: 50 passed
• cargo check --locked --manifest-path src-tauri/Cargo.toml: passed
• git diff --check: passed

GitHub recognizes the workflow. Because this is a fork pull request, the remote run is currently action_required before jobs start and requires repository-maintainer approval of the public-fork workflow before CI results can appear.

Closes #164

[squarepots]

@Lampese 这个 PR 的 workflow 已经被 GitHub 识别，但当前 fork PR run 停在 action_required，job 还没有开始。

我在最后一轮 review 中也修正了 Rust formatting step：现在使用 skip_children=true，只检查本 PR 修改的 Rust 文件，避免未修改子模块中已有的格式差异造成 false failure。

当前 head：d7895fc

麻烦在 Actions 中 Approve and run，让这批 PR 可以拿到实际 CI 结果。

---

@Lampese GitHub recognizes the workflow in this PR, but the current fork PR run is stopped at action_required before any jobs start.

During the final review I also adjusted the Rust formatting step to use skip_children=true, so it checks the Rust files changed by the PR without failing on pre-existing formatting differences in unchanged child modules.

Current head: d7895fc

Please Approve and run the workflow in Actions so this PR batch can get an actual CI result.