Add CI and satisfy Tailtest validation gates

[BananaAccurate]

Summary

This is a clean validation-gates branch built from the existing stale-queue repair line:

• includes prerequisite PR Fix compact watermark rebasing and Windows test stability #8 commit f9ff682 (Fix compact watermark rebasing and Windows test stability)
• includes PR Fix stale Tailtest mtime queueing #10 commit 4e84d5a (Fix stale Tailtest mtime queueing)
• adds CI workflow coverage for Ubuntu and Windows
• applies Ruff lint/format compliance repairs so the branch passes the proposed gates

It does not include PR #9's Stop defer/no-more-tools contract change; that remains a separate focused PR.

Root cause

Upstream currently has no GitHub Actions workflows, so open PRs report no automated checks. A CI-only branch against main would be red because the current upstream baseline fails Windows tests and Ruff gates. This branch stacks the already-open prerequisite repairs with CI plus validation-gate cleanup so the proposed checks have a green target.

Changes

• Add .github/workflows/ci.yml with normal pull_request and push triggers.
• Use minimal workflow permissions: contents: read.
• Avoid pull_request_target and privileged workflow behavior.
• Run python -m pytest -q, python -m ruff check ., and python -m ruff format --check . on ubuntu-latest and windows-latest.
• Apply mechanical Ruff lint/format fixes across the existing Tailtest Python sources and tests.

Validation

Run from C:\Users\enhal\.codex\worktrees\tailtest-validation-gates at 30cbbff:

• Windows: python -m pytest -q → exit 0, 410 passed in 36.86s
• Windows: python -m ruff check . → exit 0, All checks passed!
• Windows: python -m ruff format --check . → exit 0, 38 files already formatted
• Windows: git diff --check → exit 0
• WSL/Linux: python3 -m pytest -q && python3 -m ruff check . && python3 -m ruff format --check . → exit 0, 410 passed, Ruff check passed, 27 files already formatted

Security notes

• Workflow does not use pull_request_target.
• Workflow grants only contents: read.
• No secrets or privileged repository settings are required.
• Commit metadata uses GitHub noreply identity.

Remaining limitation

Because the base repository currently has no workflow on main, GitHub may not run this newly added workflow as a required PR check until the workflow exists on the base branch. Maintainer review/merge is still required.