CI runs fmt, clippy, test, wasm32-wasip1 build, and cargo-deny on PRs

## Summary
Gate PRs on formatting, lints, tests, the WASM build, and dependency policy.

## Scope
- Add as **jobs in `.github/workflows/pull-request.yml`** alongside the existing `hooks` job — not a separate `ci.yml`. Workflows here are named for when they fire; jobs for what they check (see #21).
- Jobs: `fmt`, `clippy` (against `wasm32-wasip1`), `test`, `build` (`wasm32-wasip1`, upload artifact), `deny` with a `deny.toml` covering advisories, license allow-list, bans, and registry sources.
- Cache `~/.cargo` and `target/` keyed on `Cargo.lock`; PRs open as draft by default; jobs required for merge.
- Workflow hardening across the repo: actions pinned to full commit SHAs with a version comment, least-privilege top-level `permissions`, a `concurrency` group cancelling superseded runs on non-default branches, and `timeout-minutes` on every job.

## Acceptance
- [ ] All jobs run on PRs; fmt/clippy/deny failures block merge
- [ ] WASM artifact uploaded for manual testing
- [ ] Every action reference is a full commit SHA and every job sets a timeout