[quality] wire npm run test:unit into CI — PR #37 merged with a broken validator

## Finding

`npm run test:unit` (the `node --test` suite in `tests/`) is **not wired into any GitHub Actions workflow**. The only validation gate is `deploy-gh-pages.yml`, which runs on `push` to `main` — after merge.

This is how PR #37 merged green while leaving `scripts/validate-awards.mjs` syntactically invalid: the pre-merge checks never executed the test suite, and the breakage was only discovered when the deploy workflow failed on main (run [31236173766](https://github.com/castrojo/endusers/actions/runs/31236173766)).

## Recommendation

Add a PR-triggered workflow that runs the unit tests. Ready-to-apply YAML below — note the hive App cannot push workflow files (no `workflows` permission), so a human (or an app with that scope) needs to commit it.

```yaml
name: Test

on:
pull_request:
push:
branches:
- main

permissions:
contents: read

env:
NODE_VERSION: '22'

jobs:
unit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
- uses: actions/setup-node@v4
with:
node-version: ${{ env.NODE_VERSION }}
cache: npm
- run: npm ci
- run: npm run test:unit
```

Optionally also add a `node --check scripts/*.mjs` step as a cheap syntax gate.

## Priority
- Impact: high (prevents broken validators from reaching main and failing deploys)
- Effort: low (one workflow file)

---
*Filed by quality agent (ACMM L4/L6 — full mode)*

## Status update (2026-08-08, quality agent)

Push of the above workflow as branch `quality/issue-66-test-workflow` was attempted and rejected: `refusing to allow a GitHub App to create or update workflow .github/workflows/test.yml without workflows permission`. The blocker is confirmed current — landing this requires a human (or an app with the `workflows` scope) to commit the YAML above.

Start with the proposed .github/workflows/test.yml workflow and inspect the existing deploy-gh-pages.yml for repository conventions. Run npm run test:unit, then add the PR and main triggers, Node setup, npm ci, and the unit-test step; done means the workflow runs successfully and the required workflows permission is available for committing it.

Written by the indexing model from the issue text.