ci: add focused pull request validation

[squarepots]

本 PR 为 pull request 增加只读验证 workflow，避免回归等到 release workflow 才发现。

• Ubuntu frontend job 使用 frozen lockfile，运行 pnpm build 和聚合的 pnpm test。
• pnpm test 使用 Node 内置 test runner 的 tests/*.test.* 发现约定，覆盖 .test.ts 和 .test.mjs，因此 browser-runtime、web-boundary、backup-passphrase、warmup-policy、release-source 等 focused suite 合并进来后无需再维护手写列表。
• Ubuntu Rust job 安装 Tauri Linux 编译依赖，检查本 PR 修改的 Rust 文件格式，并运行 cargo test --locked。
• macOS 与 Windows 各运行 cargo check --locked，覆盖 platform-gated Tauri/Rust 路径。
• workflow 使用 pull_request、同一 PR 的旧运行会被取消，并且只授予 contents: read；不包含 release、签名或发布权限。

验证

• pnpm install --frozen-lockfile：通过
• pnpm test：当前 checkout 的 13 项通过；聚合命令按文件名发现后续 focused suite
• pnpm build：通过
• cargo test --locked --manifest-path src-tauri/Cargo.toml：50 项通过
• cargo check --locked --manifest-path src-tauri/Cargo.toml：通过
• git diff --check：通过

GitHub 已识别该 workflow；当前已验证的 PR 运行（run 35448726405）已完成，Frontend、Rust tests and format、macOS 和 Windows 四个 job 均通过。

Closes #164

---

This PR adds read-only pull-request validation so regressions are caught before the release workflow.

• The Ubuntu frontend job installs from the frozen lockfile and runs pnpm build plus the aggregate pnpm test command.
• pnpm test uses Node’s built-in test runner with the tests/*.test.* filename convention, covering both .test.ts and .test.mjs. The browser-runtime, web-boundary, backup-passphrase, warmup-policy, and release-source focused suites will therefore be included when their existing PR branches are combined without another hand-maintained list.
• The Ubuntu Rust job installs the Tauri Linux build dependencies, checks formatting for Rust files changed by the PR, and runs cargo test --locked.
• macOS and Windows each run cargo check --locked to cover platform-gated Tauri/Rust paths.
• The workflow uses pull_request, cancels older runs for the same PR, and grants only contents: read; it has no release, signing, or publishing permissions.

Validation

• pnpm install --frozen-lockfile: passed
• pnpm test: 13 current-checkout tests passed; the aggregate discovers later focused suites by filename
• pnpm build: passed
• cargo test --locked --manifest-path src-tauri/Cargo.toml: 50 passed
• cargo check --locked --manifest-path src-tauri/Cargo.toml: passed
• git diff --check: passed

GitHub recognizes the workflow. The currently verified PR run (35448726405) completed successfully; Frontend, Rust tests and format, and the macOS and Windows platform compile jobs all passed.

Closes #164

Restores #175 after the source fork was accidentally deleted.