ci: run tests on pull requests and pushes to main

[ryanlitalien]

Problem

The only workflow in this repo, .github/workflows/publish.yml, triggers exclusively on v*.*.* tag pushes. Tests never run on a pull request or on a push to main, so a regression is only caught at publish time, which is too late.

Change

Adds .github/workflows/ci.yml:

• Triggers on push to main and on pull requests targeting main.
• One job (cli-node) on ubuntu-latest, timeout-minutes: 10.
• Checks out the repo (actions/checkout@v7) and sets up Node from .nvmrc (actions/setup-node@v7), matching how publish.yml picks its Node version.
• Runs npm test, which is node --test.

No install step. package.json has no dependencies and no devDependencies, and there is no package-lock.json, so npm ci would fail on a missing lockfile and add nothing.

No lint or build step. There is no tsconfig.json, no .ts source, and no lint, build, or typecheck script in package.json to gate the PR on. The CLI is plain Node (bin/butter is a shebang script), not TypeScript.

Does not touch publish.yml, README.md, package.json, or any test/source file.

Stacking note

This stacks alongside #2 (ci/tag-version-guard-and-github-release), which adds a tag-version guard and GitHub Release creation to publish.yml. The two PRs touch different files (publish.yml there, a new ci.yml here) and do not conflict.

Verification

Ran locally, matching the workflow's steps exactly:

$ python3 -c "import yaml;yaml.safe_load(open('.github/workflows/ci.yml'))"
(no output, parses cleanly)

$ npm test

> butterstack-cli@0.1.0 test
> node --test

✔ F1: --host is honored, not silently ignored
✔ F1: with no --host and no BUTTERSTACK_HOST, the CLI falls back to the last-logged-in host, not always the default
✔ F1: refuses to send a stored credential to a host different from the one it was minted for, and never contacts it
✔ F1: an explicit BUTTERSTACK_API_TOKEN env override bypasses the host-binding check (explicit user intent)
✔ F2 (real flow): auth login refuses to persist a token granted more scope than --scope requested
✔ F2 (real flow): auth login persists the token when granted scope matches what was requested
ℹ tests 6
ℹ pass 6
ℹ fail 0

actions/checkout@v7 and actions/setup-node@v7 were confirmed as the current major release before use.