Restore GitHub Actions CI with a minimal workflow #1

Context: CI was removed during the Buck2 migration and nothing enforces build/test/lints on PRs today. This is the blocker for almost every other quality initiative.

Scope:

• Create .github/workflows/ci.yml with jobs:
  • fmt → cargo fmt --check
  • check → just check
  • clippy → just clippy
  • test-host → just test
  • test-qemu-riscv64 → smoke test (tracked separately; start with continue-on-error: true)
  • buck2-audit → a few buck2 audit sanity checks
• Use DeterminateSystems/nix-installer-action + magic-nix-cache for the toolchain.
• Cache buck-out/v2/cache via actions/cache.
• Pin runners to ubuntu-24.04, not ubuntu-latest.

Out of scope: miri, docs, benches, merge queue — each has its own issue.

Acceptance: a PR with a trivial change goes green end-to-end.