Add general-purpose pull request validation for Rust and Android

[4Luke4]

Summary

Add a dedicated pull-request validation workflow that provides fast host-side Rust checks and a reproducible Android ARM64 debug build for routine development changes.

Motivation

The existing Android workflow is release-oriented: it runs manually or for version tags, requires signing credentials, builds APK and AAB release artifacts, generates manuals, and publishes GitHub releases. That makes it unsuitable as the standard validation path for pull requests.

This workflow establishes a secret-free, least-privilege CI baseline that can be reused by all future pull requests rather than being tied to any specific bug fix.

What changed

Rust checks

• verifies repository formatting with cargo fmt --all --check
• checks all host targets with the committed lockfile
• runs all host tests with the committed lockfile
• caches Cargo registry, Git, and target data
• enforces a 30-minute timeout

Android ARM64 debug build

• installs the stable Rust toolchain, Java 17, Gradle 8.14.3, LLVM, and the repository's patched xbuild
• prepares the same Android NDK r28 compatibility layout used by the release workflow
• caches both Rust build data and the prepared Android NDK
• builds an unsigned ARM64 debug APK without repository secrets
• uploads the generated debug APK for seven days
• enforces a 60-minute timeout

Workflow hygiene

• runs on pull requests, pushes to main, and manual dispatches
• grants only read access to repository contents
• cancels superseded runs for the same pull request or ref
• uses explicit failure behavior when the expected APK is not produced

Security and operational considerations

• no signing credentials or release secrets are exposed
• the workflow does not publish packages, releases, tags, or repository content
• generated APKs are short-lived CI artifacts and are not release-signed
• action dependencies use established major-version channels already common in the repository ecosystem

Validation

• reviewed against the current release workflow's Gradle and Android NDK setup
• YAML structure parsed successfully
• branch comparison confirms that the PR adds only .github/workflows/pr-validation.yml

Follow-up

Once this workflow is merged and stable, emulator smoke testing can be introduced as a separate, opt-in workflow before considering it as a required check. Physical mouse, touchpad, and Samsung DeX behavior will still require a physical-device test path or a self-hosted ADB runner.