ci: add minimal CI workflow (build + short test + vet + govulncheck)

Adds GitHub Actions CI on push to main/dev + PRs:
- go build ./...
- go test -count=1 -short -timeout 300s ./...
- go vet ./...
- govulncheck (non-blocking, reports advisories)

GOWORK=off per repo convention.

.github/workflows/ci.yml

@@ -0,0 +1,45 @@
+name: CI
+
+on:
+  push:
+    branches: [main, dev]
+    tags: ['v*']
+  pull_request:
+    branches: [main, dev]
+
+permissions:
+  contents: read
+
+env:
+  GOWORK: off
+
+jobs:
+  test:
+    name: Build + Test (linux/arm64 + linux/amd64 stub)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache-dependency-path: go.sum
+
+      - name: Build
+        run: go build ./...
+
+      - name: Test (short)
+        run: go test -count=1 -short -timeout 300s ./...
+
+      - name: Vet
+        run: go vet ./...
+
+  govulncheck:
+    name: govulncheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - run: go install golang.org/x/vuln/cmd/govulncheck@latest
+      - run: govulncheck ./... || true