add CI test gate

[mtmtian]

What changed

Add a minimal, credential-free GitHub Actions gate for pull requests, main pushes, and manual runs.

The workflow:

• verifies no files under profiles/ are tracked
• checks all deployment shell scripts with bash -n
• runs the complete Python unittest suite
• checks out without persisting GitHub credentials and pins official actions to v6 commits

Why

The deployment repository previously had no GitHub checks. The gate makes the documented local validation reproducible without accessing node profiles, generated client configs, provider credentials, or remote hosts.

Validation

• YAML parsed successfully
• profile tracking assertion passed
• shell syntax passed
• python3 -m unittest discover -s tests -p 'test_*.py' -v — 32 tests passed, 1 optional Mihomo test skipped
• git diff --check