ci: add GitHub Actions test workflow

[batuthzcode]

Summary

• add the first GitHub Actions workflow for pull requests and pushes to main
• provision Python 3.11, cache pip downloads, install development extras, and run the complete pytest suite
• pin actions/checkout and actions/setup-python to reviewed immutable release commits
• add contract tests for workflow triggers, permissions, action pins, environment setup, command order, concurrency, and timeout
• enforce the declared Python 3.11 syntax floor across all checked-in Python sources
• document the CI security model, local equivalent, validation results, and planned analyzer/scanner jobs

Why

The repository had no automated pull-request validation, so regressions could only be caught by local testing. Backlog 5.1 requires a minimal, inspectable test pipeline before adding static-analysis, dependency-scanning, and artifact jobs.

Python 3.11 compatibility fix

The first real CI run exposed a Python-version mismatch: src/static_analyzer/analysis_engine.py used the Python 3.12 PEP 695 type statement even though pyproject.toml declares Python 3.11 as the minimum supported version.

The fix replaces that statement with a Python 3.11-compatible TypeAlias declaration. A repository-wide regression test now parses every Python source file under src, sample_app, tools, and tests using the Python 3.11 grammar so newer-only syntax is caught before reaching CI.

Security and operational impact

• grants the workflow token only contents: read
• disables persisted checkout credentials
• uses pull_request, not the privileged pull_request_target event
• pins action code to full 40-character commit SHAs
• limits the test job to 10 minutes
• cancels superseded runs for the same workflow and Git ref
• uses no repository secrets, deployment environments, or write permissions

Validation

• GitHub Actions CI run #2: passed
• CPython 3.11.15 on ubuntu-latest: 985 passed
• complete local pytest suite: 985 passed
• focused compatibility, workflow, and analysis-engine suite: 65 passed
• workflow contract suite: 7 passed
• workflow YAML parse check: passed
• static analyzer against src and tools: 0 findings
• static analyzer against sample_app: exactly 5 expected findings
• checked-in security report drift check: passed
• Python compile check, line-length scan, trailing-whitespace scan, and git diff --check: passed

Follow-up

A subsequent PR will add deterministic static-analysis and dependency-scan gates plus JSON report artifact uploads after this foundation workflow.