[TASK] Add CI workflow: lint, typecheck, tests

[dvlpjrs]

Changes

• Add .github/workflows/ci.yml running on pull_request and pushes to main, with a per-ref concurrency group that cancels in-progress runs and a minimal permissions: contents: read block.
• lint job (Python 3.12): uv sync --frozen, ruff format --check ., ruff check ., uv lock --check, plus sh -n / bash -n syntax checks on scripts/install.sh.
• typecheck job (Python 3.12): uv run --frozen pyright.
• test job: matrix across Python 3.10–3.13, uv run --frozen pytest -m "not live" -n auto (fail-fast: false).
• Actions pinned to the same SHAs as release.yml (actions/checkout v7, astral-sh/setup-uv v9.0.0) with setup-uv caching enabled.
• Wire up the live marker: tests/integration/test_live.py documented itself as live-only but never applied the marker, so -m "not live" didn't deselect it and its fixtures failed in any environment without API credentials. Added module-level pytestmark = pytest.mark.live — marker wiring only, no test logic changed.
• Fix pre-existing lint/type errors so CI lands green: applied ruff format (14 files), fixed the 8 ruff check errors (UP035/UP045/I001 autofixed, E501s resolved by formatting), and the 4 pyright errors in tests/sdk/ (None-narrowing in test_agents.py, dict[str, Any] parametrize annotation in test_client.py, type: ignore[arg-type] for the intentional dict-message coercion in test_chat.py). Mechanical fixes only.

Commands mirror scripts/check, split into jobs so tests can run as a matrix and CI can exclude live tests (which scripts/check does not).

Testing

• Ran every CI command locally on this branch: uv sync --frozen, ruff format --check . (109 files clean), ruff check . (all checks passed), pyright (0 errors), uv lock --check, sh -n/bash -n scripts/install.sh — all green.
• pytest -m "not live" -n auto in a CI-equivalent env (no .env, no GUMLOOP_* env vars): 407 passed, 0 failed, 0 errors, 19 deselected (all of tests/integration/test_live.py, now correctly excluded by the live marker).
• Validated the workflow YAML parses.