ci: run tests on pull requests and pushes to main

[ryanlitalien]

Problem

The only workflow in this repo, .github/workflows/publish.yml, triggers exclusively on v*.*.* tag pushes. Tests never run on a pull request or on a push to main, so a regression is only caught at publish time, which is too late.

Change

Adds .github/workflows/ci.yml:

• Triggers on push to main and on pull requests targeting main.
• One job (mcp-node) on ubuntu-latest, timeout-minutes: 10.
• Checks out the repo (actions/checkout@v7) and sets up Node from .nvmrc (actions/setup-node@v7), matching how publish.yml picks its Node version.
• Runs npm test, which is node --test.

No install step. package.json has no dependencies and no devDependencies, and there is no package-lock.json, so npm ci would fail on a missing lockfile and add nothing.

No lint or build step. There is no lint, build, or typecheck script in package.json to gate the PR on. This package is plain Node (index.js), not TypeScript.

Does not touch publish.yml, README.md, package.json, or any test/source file.

Stacking note

This stacks alongside #2 (ci/tag-version-guard-and-github-release), which adds a tag-version guard and GitHub Release creation to publish.yml. The two PRs touch different files (publish.yml there, a new ci.yml here) and do not conflict.

Verification

Ran locally, matching the workflow's steps exactly:

$ python3 -c "import yaml;yaml.safe_load(open('.github/workflows/ci.yml'))"
(no output, parses cleanly)

$ npm test

> butterstack-mcp@0.1.0 test
> node --test

✔ initialize handshake reports the unscoped package name
✔ tools/list enumerates all twelve tools
✔ refuses to send a stored credential to a host different from the one it was minted for, and never contacts it
ℹ tests 3
ℹ pass 3
ℹ fail 0

actions/checkout@v7 and actions/setup-node@v7 were confirmed as the current major release before use.