Nothing runs phpcs or phpunit in CI

The repo has two workflows, `create-release.yml` and `lint-next-version.yml`. The only check a pull request gets is `next-version-tags`, which runs `scripts/check-next-version-tag.sh`. Neither phpcs nor phpunit runs anywhere.

#36 made both work locally — `.phpcs.xml.dist`, `scripts/phpcs.sh`, `scripts/phpcs-changed.sh`, and a `make test` that drives the wp-env container. The commands are there and reliable now. Nothing calls them on a push.

That gap has already cost something. #29 carried two phpcs violations on lines it had changed itself. They surfaced only because `make lint` got run by hand after #36 landed — the PR was green and mergeable the whole time.

## What it needs

- A workflow running `composer cs` against the PR base, which is what `make lint` does. `scripts/phpcs-changed.sh base` resolves the merge base itself, so it wants a checkout with full history (`fetch-depth: 0`) and should otherwise work as-is.
- A workflow running PHPUnit. This is the awkward half. `make test` goes through wp-env and Docker, which is heavier in Actions than pointing phpunit at a WordPress checkout via `WORDPRESS_DEVELOP_DIR`. Worth settling which of the two CI uses before writing it — a second, divergent path is how CI and local drift until only one of them is trusted.

## Worth deciding at the same time

- Whether either check becomes required. Trunk is deliberately not PR-gated, so this is a question about the PR checks, not about changing that.
- Which PHP versions the test job runs. `composer.json` says `>=7.4` and the local container is on 8.3, so a single job would leave most of the supported range unexercised. The phpunit config split (`phpunit.9`/`phpunit.11`) already anticipates more than one.

Start by reading create-release.yml and lint-next-version.yml, then inspect scripts/phpcs-changed.sh, .phpcs.xml.dist, Makefile, composer.json, and the phpunit.9/phpunit.11 configuration. Run the existing make lint and make test commands locally to understand their assumptions. Done means pull requests run the selected coding-standard and PHPUnit checks, with the PHP versions and required-check behavior decided explicitly.

Written by the indexing model from the issue text.