test: add backend safety regression suite and CI

[harshitethic]

Problem

PatchPilot's backend currently has no automated regression suite or GitHub Actions workflow, so core safety helpers and request validation can regress without a visible CI signal.

What this adds

• regression tests for repository/branch name normalization
• structured JSON parsing coverage
• exact edit application behavior
• repository path-escape rejection
• atomic edit behavior when a later edit is invalid
• required GitHub token handling
• RunRequest iteration validation
• health contract coverage
• GitHub Actions CI on Python 3.11 and 3.12
• source compilation before the test suite
• least-privilege contents: read workflow permissions

Validation

I could not execute the suite locally in the current automation environment because outbound GitHub resolution is blocked, so no local test result is claimed. This PR intentionally adds GitHub Actions as the authoritative validation path; CI should run python -m compileall app tests and python -m unittest discover -s tests -v for both supported Python versions.

Scope

This is deliberately limited to backend regression coverage and CI. It does not change runtime behavior or add product features.