Add required CI checks

[kuanzema]

Summary

• run tests and the production build for every pull request to main
• audit production dependencies for high-severity vulnerabilities
• use read-only repository permissions and cancel superseded runs

Verification

• npm test (6 tests pass)
• npm run build
• npm audit --omit=dev --audit-level=high (0 vulnerabilities)

This bootstraps the test check that the main branch ruleset will require for future changes.