fix(ci): add PR preflight harness

[rawwerks]

Summary

• Add scripts/pr-preflight.sh to fetch origin/main, simulate merging the current HEAD into that base, and run local CI-equivalent checks.
• Add npm run ci:pr for the CLI test/typecheck/build/audit gate.
• Wire workflow syntax coverage and document the preflight requirement in AGENTS.md.

Verification

• bash -n scripts/pr-preflight.sh
• node --check tools/cli/scripts/audit-policy.mjs
• actionlint via go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7
• cd tools/cli && npm ci && npm run ci:pr
• OpenProse smoke dry-run for required cases
• ./scripts/pr-preflight.sh