ci: run the Makefile check gates on pull requests

`release.yml` only runs on `v*` tags, so nothing verifies a commit
before it lands on `main`. `main` is currently red on three of the five
gates `make check` defines, which is the drift this is meant to catch.

Adds a single job running the three Rust gates verbatim as the Makefile
spells them:

    cargo fmt --all -- --check
    cargo clippy --workspace --all-targets -- -D warnings
    cargo test --workspace --all-targets

Conventions follow release.yml so the two workflows stay consistent:
ubuntu-22.04, the same apt packages (the workspace includes
apps/desktop/src-tauri, so even `cargo check` needs webkit2gtk),
dtolnay/rust-toolchain@stable and Swatinem/rust-cache@v2 with the same
`. -> target` workspace key.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -0,0 +1,45 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  rust:
+    name: Rust
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+
+      # The workspace includes apps/desktop/src-tauri, so even `cargo check`
+      # needs the same system libraries the release workflow installs.
+      - name: Install Linux system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: ". -> target"
+
+      - name: cargo fmt --all -- --check
+        run: cargo fmt --all -- --check
+
+      - name: cargo clippy --workspace --all-targets -- -D warnings
+        run: cargo clippy --workspace --all-targets -- -D warnings
+
+      - name: cargo test --workspace --all-targets
+        run: cargo test --workspace --all-targets