Add a CI workflow

The repository had no build or test workflow — only pages.yml, a site
deploy triggered by site/** — which is why a workspace that does not
compile reached main. `just ci` existed and was well shaped; nothing
invoked it.

Run the documented tiers through just, so CI and a contributor's laptop
cannot drift and the tier definitions keep one home in the justfile.
Notes on the setup:

- protoc is installed explicitly: prost-build does not vendor it, and
  walgit-proto fails with NotFound without it.
- The toolchain version is deliberately not restated here. `rustup show`
  honours rust-toolchain.toml, so the pin has one home too.
- The SPA and the SDK are built before the tests run. This is required,
  not cosmetic: build.rs only writes a placeholder index.html, and
  api_v1's v1_surface_and_browser_lane asserts /repos.js and /repos.mjs
  serve 200. It also runs oxlint --deny-warnings and tsc --noEmit, so
  the web gate comes along for free.

The workflow is advisory until CI is marked required on main in the
repository settings.