chore(ci): close 0013 with evidence that CI gates pull requests

[oddurs]

Problem

Cairn item 0013 asks for CI that formats, lints and tests every pull request. The ci workflow from bootstrap already did that, but nothing proved it: nobody had shown that a clippy warning fails a PR, or measured a cached run.

Approach

No workflow change. This PR records the evidence in the item, ticks the three criteria and closes 0013.

1. Runs scripts/task check and nothing that duplicates it. The check job runs ./scripts/task check and nothing else. static runs scripts/task build:static, a release musl build that check doesn't do. required collects the job results.
2. A clippy warning fails CI. Canary PR test: clippy canary for 0013 (do not merge) #6 changed liam's version_line to use return format!(...);. Locally, rustc gave 0 warnings and clippy failed on clippy::needless_return. CI run 37085900711 on 1feb7cb failed check with exit 101, so required failed and the PR's merge state was BLOCKED. Branch protection on main requires required (strict). test: clippy canary for 0013 (do not merge) #6 is closed and its branch deleted.
3. A cached run takes under 5 minutes. In run 37085707747, rust-cache restored a full key match and pnpm got a cache hit. The check job took 36 s and the whole run 46 s.

Budget impact

None. CI wall time is unchanged: about 46 s per cached PR run.

Look at this sceptically

• The pre-commit hook runs clippy, so the canary commit could not be made locally without --no-verify. I created it on the server through the GitHub contents API instead. No local gate was skipped, but the canary branch never went through the hooks. That is the point of the canary, and it's still worth knowing.
• Criterion 3 was measured on today's small workspace. The 5-minute bound has about 6x headroom, which will shrink as crates 0017-0020 land. This PR's own run below is a second data point.
• The cairn notes cite run IDs. GitHub expires Actions logs after its retention period, so the notes carry the numbers as well as the IDs.

Checks

• scripts/task check: green locally.
• cairn check: ok, 97 items, 0 warnings.