ci: add provider-native validation workflow

[andrei-hasna]

Summary

• add one provider-native CI workflow for pull requests and pushes to main
• keep permissions at contents: read, cancel superseded runs, and bound the single Linux job to 15 minutes
• check out the exact pull-request head, pin Bun 1.3.14 and immutable action revisions, disable setup-action cache persistence and token forwarding, then run frozen install, full tests, typecheck, and build

Validation

• Bun YAML parse and explicit workflow contract assertions
• checksum-verified actionlint 1.7.12 via independent reviewer
• isolated Bun 1.3.14 frozen install, 16 tests, typecheck, and build
• staged and committed-range non-printing gitleaks and credential-pattern scans
• independent exact-head adversarial review: no P0/P1/P2/P3 findings after remediation
• provider-native CI success at exact final head: https://github.com/hasna/tai/actions/runs/30019783778

Todos: E-00117
Acceptance scope: tai-provider-ci-v1