Foundation: CI baseline for lint, tests, and the README catalog check #62

Goal

Put checks on every pull request as early as possible, so the rest of the foundation lands behind a gate.

Scope

• A GitHub Actions workflow on pull requests and pushes to main: ruff check, ruff format --check, pytest, and python tools/render_catalog.py --check.
• Tests for tools/render_catalog.py: region replacement, published detection when recipes/<slug>/notebook.ipynb exists, and --check exit codes.
• Pinned action versions, minimal permissions (contents: read), dependency caching.

Acceptance criteria

• The workflow runs and passes on its own pull request
• A deliberately stale README makes the catalog check fail (shown in the pull request description, not left in the branch)
• Job names are stable so they can be made required checks later
• Lint and tests pass in CI, or locally with the output pasted in the pull request if CI does not exist yet

Dependencies

• Blocked by Foundation: project scaffolding and Python package skeleton #61 (project scaffolding and Python package skeleton)
• Unblocks Foundation: CI executes every notebook offline and validates fixtures #69, Foundation: repository hygiene for secrets, dependencies, and notebook outputs #71
• Tracked in Epic: Foundation #74

References

• Recipe contract
• Catalog
• TypeSafe documentation index for tools: https://docs.typesafe.ai/llms.txt
• Python SDK: https://docs.typesafe.ai/sdk/python