chore: add qa checks

[sagar-kap]

Description

Adds a CI workflow that runs quality checks on every pull request and on
every push to main. The repository previously had no PR-time enforcement
of tests, linting, or go mod hygiene — quality was only enforced via
local pre-commit hooks, which contributors without the hooks installed
(and Dependabot bumps) would bypass entirely. This change closes that gap
with a hand-rolled GitHub Actions workflow that mirrors the local
pre-commit gates one-to-one.

Modifications

• .github/workflows/qa-checks.yml (new) — surfaces as the QA Checks status on
  PRs. Triggers on pull_request and push to main. Two jobs:
  • go — runs on ubuntu-latest, uses go-version-file: go.mod so the Go version
    always matches the module declaration. Steps:
    • go mod tidy followed by a git diff --exit-code check on go.mod / go.sum, so
      out-of-date module files fail the PR with a clear error pointing at the fix.
    • go vet ./...
    • go test -race ./... (the -race flag catches data races that the default test
      runner misses).
    • golangci-lint via golangci/golangci-lint-action@v6, pinned to v2.2.2 to
      match .pre-commit-config.yaml exactly — so local and CI lint results agree.
  • docs — runs on ubuntu-latest inside docs/. Uses pnpm 11 with the Nuxt-aware
    ESLint flow:
    • pnpm install --frozen-lockfile
    • pnpm exec nuxt prepare (regenerates .nuxt/eslint.config.mjs, which the project's
      ESLint config imports — matches the workaround documented in .pre-commit-config.yaml).
    • pnpm lint (runs eslint .).
• Permissions: workflow declares contents: read only — minimum needed and follows
  least-privilege defaults.