ci: run tests and lint on every PR

[rahlk]

There is no CI on PRs or pushes: .github/workflows/ contains only release.yml, triggered on v*.*.* tags. Nothing runs tests or lint until release time.

Scope

• Workflow on pull_request / push to main: make test + lint (flake8 / pylint / black --check).
• Matrix: Linux + macOS, Python 3.11 (add 3.12+ if deps allow).
• Resolve the coverage-gate mismatch: pyproject.toml sets --cov-fail-under=50 while the Makefile (which CI would use) overrides to 33 — pick one number and enforce it.
• Java analyzer tests need a JDK in the runner (mirror the setup in release.yml).

Acceptance: a PR that breaks a test or a lint rule goes red.

Part of #193. Branch: chore/issue-<n>.