ci: add hosted validation workflow

[quick-ricon]

Summary

Adds hosted CI for modules, adapted from KnickKnackLabs/template:

• PR / main / manual workflow dispatch triggers
• Ubuntu + macOS matrix
• mise setup/install
• rudi install to provide the git-crypt backend used by rudi-backed setup tests
• whitespace diff-check
• full mise run test
• codebase lint "$PWD"
• generated README check via KnickKnackLabs/readme@v0.3.1

Also enables the github-actions codebase lint rule now that the repo has a workflow to lint.

Closes #51.

Local validation

• mise run test — 135/135 BATS
• codebase lint "$PWD" — 9/9 including github-actions
• mise exec shiv:readme@0.3.1 -- readme build --check
• git diff --check origin/main...HEAD and local git diff --check

Hosted validation

The first run exposed that clean GitHub runners lacked the rudi/git-crypt backend. The branch now installs that backend via rudi install; the updated run should prove the final workflow.

[quick-ricon]

Updated after hosted CI exposed two clean-runner assumptions: the workflow now calls rudi install for the git-crypt backend, and test fixture repos now configure local Git identity instead of relying on ambient/global identity. Local CI-like smoke passed with Git identity env unset. Re-running hosted checks.

[quick-ricon]

Updated again after Ubuntu exposed commits inside cloned module repos. Test helper now exports deterministic Git author/committer env defaults so fixture repos and cloned module repos do not depend on global Git config. Local CI-like full suite passed with Git identity env unset; lint/readme/diff checks remain green.