ci: validate pull requests with the release test gates

[doodlewind]

Context

The repository currently runs its full JavaScript, TypeScript, Rust, golden, and tape gates only from the release-tag workflow. PR #176 was validated locally, but pull requests have no authoritative check that prevents those gates from drifting or being skipped.

Acceptance criteria

• Add a pull-request workflow for the release-relevant tests that can run hermetically without physical devices or private SDK archives.
• Include bun run test, TypeScript, Rust core/workspace/Symbian host tests, web goldens, and deterministic tape replay, or document a justified split for expensive jobs.
• Cache Bun and Cargo inputs without weakening lockfile checks.
• Keep real-device E7 and proprietary toolchain validation as explicit manual evidence rather than pretending it is CI-hermetic.
• Make the resulting checks required before merge once runtime and cost are understood.