Add pull request validation workflows #9

Goal

Run the existing automated tests and release validation in GitHub Actions, providing clear checks for pull request review.

Distinguish validator regression tests from release-candidate eligibility checks.

Scope

• Run automated tests and package installation checks on pull requests and main updates.
• Provide sufficient Git history to resolve immutable inventory references.
• Validate added or modified release candidates against their recorded inventories.
• Run bounded Docker Hub verification for changed candidates after shared prerequisites pass.
• Exclude observation records and synthetic examples from candidate discovery.
• Reject deletion or modification of previously merged release manifests; changes require a new release ID and file.
• Treat the existing legacy baseline as a regression fixture with an explicitly asserted failure result.
• Document check names, trigger behavior, and repository-protection settings for the owner.

Acceptance criteria

• Automated tests and package installation run successfully in GitHub Actions.
• Candidate discovery handles additions, modifications, renames, and deletions explicitly.
• Changes to observation records do not accidentally trigger candidate validation.
• Changed candidates cannot pass the release check with validation or execution errors.
• Legacy ineligibility is never ignored or converted into release eligibility.
• The historical baseline regression asserts its expected legacy failures without making unrelated code/documentation PRs fail.
• Missing inventory Git objects fail explicitly rather than using working-tree substitutes.
• Network failures and rate limits produce a failed registry check with actionable diagnostics.
• Workflows use minimal permissions and require no registry credentials.
• Pull request code is not executed through privileged pull_request_target workflows.
• Tests cover candidate discovery and release-file immutability rules.
• Public workflow summaries are concise and omit local-machine details and sensitive data.
• Documentation distinguishes available checks from owner-configured merge protection.

Boundaries

GitHub Actions and validation orchestration only.

Do not implement Compose, image builds/publication, promotion automation, legacy exceptions, or deployment.

Do not modify baseline digests, other repositories, cloud resources, or cluster state. Do not configure branch protection or rulesets; document the required owner settings.

Use Related to #N. Keep this issue open after PR merge until a closing comment and manual closure.