Add per-PR demo bundle CI workflow (#50)

[HuggeK]

Closes #50.

Summary

On every push to any pull request (drafts included), CI now builds the golf tiles from a small committed fixture and uploads a demo bundle artifact you can test in your local browser:

• tests/fixtures/golf-fixture.osm.pbf — 1.5 MB extract around Emmaboda GK + Nybro golfklubb (cut 2026-07-05 from sweden-latest via the committed extract-config.json), with a .gitignore exception so it stays committed.
• .github/workflows/pr-demo-bundle.yml — builds the repo's Docker image with the same GHA build cache as docker-publish.yml (schema/style PRs never recompile tilemaker), runs the PR's own run_all.sh/process.lua/style via bind mount, validates the style JSON and the PMTiles header, then uploads golftiles-demo-pr<N>-<sha> (14-day retention). Superseded runs are cancelled per-PR.
• demo/local-viewer.html — bundled as index.html; loads the PR's style verbatim and rewrites its pmtiles:// source URLs at runtime against window.location, so it works on any localhost port. Opens over Emmaboda GK at zoom 14.
• demo/BUNDLE_README.txt — one-command instructions (npx http-server -p 8080 .).

How reviewers use it

PR page → Checks → PR demo bundle → Artifacts → download, unzip, npx http-server -p 8080 ., open http://localhost:8080/.

Verification (all done locally before this PR)

• Fixture verified to contain Emmaboda Golfklubb + Nybro golfklubb (osmium tags-filter).
• Full pipeline run on the fixture in the repo's Docker image: exit 0, output is a valid PMTiles v3 archive (101 addressed tiles, all 7 schema layers, Emmaboda's z14 tile present with the same content as a full-Sweden build).
• The assembled bundle was served with a Range-request-capable server and loaded in a headless browser: the map renders with the OpenStreetMap + golfTiles attribution (proof that style + tiles loaded).

Caveats

• The first CI run (or first after a Dockerfile/submodule change) compiles tilemaker (~15–30 min). Subsequent pushes to the same PR are GHA-cache hits and take a few minutes. PR-scoped caches can read caches written on main, so optionally also building the image on main pushes would warm the cache for every new PR.
• Fork-PR safe: the workflow uses no secrets and only contents: read; artifact upload works with the read-only fork token.
• Downloading artifacts requires being logged in to GitHub.
• python -m http.server will NOT work for viewing (no HTTP Range support) — the bundle README warns about this.

🤖 Generated with Claude Code