Add CI: compile-check and lint every script on push

[utk2103]

Nothing currently stops a broken script from being merged. scripts/pdf2doc.py has been committed with an ImportError and two wrong method names, and no check caught it.

What to do

Add .github/workflows/ci.yml that runs on every push and pull request:

- python -m compileall -q scripts/    # every script must at least parse
- ruff check scripts/                 # lint: unused imports, undefined names

Pin a Python version matrix of 3.10 and 3.12 so syntax-version problems surface early.

Acceptance criteria

• Workflow runs on push and pull_request against main.
• compileall step fails the build on a syntax error.
• Ruff configured permissively — this is a teaching repo, so catch real errors (F rules: undefined names, unused imports) and don't enforce style opinions that would make every existing file red.
• Ruff config lives in pyproject.toml or ruff.toml, not inline in the YAML.
• The workflow passes on main as it is today, or the PR explains exactly which pre-existing failure it excludes and why.
• Add the CI status badge to the README.

Note

Scripts needing third-party packages or input files can't be executed in CI — parse + lint is the right scope here. Don't try to run them.

Good first issue for anyone wanting GitHub Actions practice.