CI does not run on pull requests #99

What's wrong

The build workflow (.github/workflows/core-build.yaml) only has on: push. It never runs on pull requests, so PRs from forks get no checks at all. On #98 there were no CI results and the reviewer had to ask for the build and test output by hand.

Also, what CI does run is thin. It runs make (which is check + build) and make test, all with default features only. The sled, rocksdb, evmap, sms-rustfs and mic-device features, plus benches and examples, are never compiled in CI, so they can break without anyone noticing. Nothing runs cargo clippy either, even though make lint already exists.

Why it matters

• Reviewers can't tell if a PR is safe without pulling it and running things locally.
• Breakage in non-default features, benches and examples only shows up later, when someone happens to build them.

How it could look

• Add pull_request next to push in the workflow on: block.
• Add a step for cargo check --all-features --all-targets.
• Add a step for make lint (clippy). Start without -D warnings and turn it on once it's clean (CLIPPY_DENY_WARNINGS=1 already exists in the Makefile).
• Fork PRs don't get secrets, so the test step that uses OPENAI_API_KEY needs to be skipped or made optional there. Easiest is a condition like if: github.event.pull_request.head.repo.fork == false on the steps that need the secret.