ci: add pytest gate for PRs and pushes to main

Adds .github/workflows/tests.yml: checkout, Python 3.11 (matching
work/Dockerfile's python:3.11-slim-bookworm base), pip install -r
requirements.txt + pip install -e ".[dev]" for pytest/pytest-asyncio,
then `python -m pytest -q -p no:cacheprovider` from work/.

docker-publish.yml is untouched (image publishing unchanged).

NOTE: origin/main currently has 6 pre-existing test failures (stale
SCHEMA_VERSION x3, expired TLE fixtures x2, one order-dependent) that
are fixed in open PR #140 (fix/green-test-suite), not this change.
This gate will be red until #140 merges — that is expected and by
design; no continue-on-error / skip was added to mask it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.github/workflows/tests.yml

@@ -0,0 +1,35 @@
+name: Tests
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: "pip"
+          cache-dependency-path: |
+            work/requirements.txt
+            work/pyproject.toml
+
+      - name: Install dependencies
+        working-directory: work
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+          pip install -e ".[dev]"
+
+      - name: Run test suite
+        working-directory: work
+        run: python -m pytest -q -p no:cacheprovider