CI: pull-request and branch test workflow

## Context

The repository only has tag-triggered `publish.yml` (Maven/pack release) and `docker.yml` (image publish); pull requests and pushes to `main` have no test gate. This adds a CI workflow that runs server tests, shared JVM tests, and pack typecheck/build on PRs and main pushes with Gradle/pnpm caching. Tag release workflows stay unchanged.

## Tasks

- [ ] New `.github/workflows/ci.yml` on `pull_request` and `push` to `main` (plus `workflow_dispatch`)
- [ ] JDK 21 (temurin) + `gradle/actions/setup-gradle` caching
- [ ] `./gradlew :server:test :app:shared:jvmTest` (and `:core:jvmTest` if applicable)
- [ ] pnpm setup with lockfile cache + `pnpm install --frozen-lockfile`, `pnpm typecheck`, `pnpm build` in `server/pack`
- [ ] Concurrency group to cancel superseded runs; least-privilege `permissions: contents: read`
- [ ] Optionally publish test reports on failure
- [ ] Note the required checks in `DEVELOPING.md` (branch protection is repo config, not workflow)

## References

- `.github/workflows/publish.yml`, `.github/workflows/docker.yml` — existing tag workflows and secret conventions
- `server/pack/package.json` — `build`, `typecheck`, `dev` scripts
- `DEVELOPING.md` — build/test commands
- `AGENTS.md` — module/test layout

## Dependencies

- None; independent. Should land early to give #1–#12 a green gate.