Run CI on GitHub Actions

[ferblape]

✌️ What does this PR do?

Ports the CircleCI pipeline to GitHub Actions with the same partitioning — one build job that compiles assets, 21 test legs (16 Gobierto modules plus others and engines, with admin/people/plans split in two) and a production deploy gated on master. Since circleci tests run --split-by=timings has no GitHub Actions equivalent, shard balancing now lives in the repo: script/ci/collect_timings sums per-file runtimes from the JUnit XML that minitest-ci already writes, master stores the result in the Actions cache, and script/ci/split_tests bin-packs each module's files across its shards (falling back to file size until the first master build lands). .circleci/config.yml is intentionally left in place so both CIs run in parallel for a few days, and is removed in a follow-up PR.

This cannot go green until these repository settings exist: CUSTOM_ENGINE_NAME_1 (variable) and the CUSTOM_ENGINE_DEPLOY_KEY, DEPLOY_BOT_TOKEN and GOBIERTO_PRODUCTION_DEPLOY_URL secrets, plus anything else currently set in CircleCI project settings that I can't see from the repo. Note the deploy key must reach every private repo script/custom_engines_ci_setup clones, not just the first engine.

🔍 How should this be manually tested?

1. Create the variable and secrets above, then push to this branch and watch the run in the Actions tab.
2. Compare the leg list and per-leg test counts against the CircleCI run on the same commit — every tests_* job must have a counterpart with a comparable N runs.
3. After the first master build, confirm the collect timings job saved a cache entry and that a subsequent branch build has its two admin shards within roughly 20% of each other.
4. Verify production deploy is skipped on branches and appears on master.

Verified locally: actionlint is clean, and the 21 legs cover 445 test files with zero overlap between them. Nothing runtime (services, engine clone, seeds, Chrome) has been exercised yet.

👀 Screenshots

N/A — CI configuration only, no user-facing change.

Does this PR changes any configuration file?

• new environment variable in .env.example?
• new entry in config/application.yml?
• new entry in config/secrets.yml?

No application configuration changes. The new values are CI-only credentials that live in GitHub repository settings (see above), mirroring what CircleCI holds today, so no Ansible role update is needed.

📖 Does this PR require updating the documentation?

• new site configuration variable?
• new site template?
• new module/submodule settings?
• significant changes in some feature?

---

Known gap, ported as-is rather than fixed here: test/models/gobierto_module_settings_test.rb and test/lib/i18n/gobierto_backend_test.rb run in no job today — the others filter -not -path '*gobierto_*' drops them by filename and no module pattern claims them. Widening it to -not -path '*/gobierto_*/*' would double-run 12 test/pub_sub/subscribers/gobierto_* files, so the real fix ("everything minus the union of the module legs") belongs in its own PR to keep this one a faithful port.