[jamiehdev]

This pull request adds a GitHub Actions workflow that runs the project checks on pushes to main and on pull requests. It also builds the static musl binary that scripts/deploy.sh ships.

Changes

• The test job runs cargo fmt --check, Clippy with -D warnings, cargo test --release, ShellCheck on the shell scripts, and scripts/check-fixtures.sh with exiftool and Pillow.
• The build job runs cargo zigbuild for x86_64-unknown-linux-musl, fails if file does not report a static binary, and uploads the binary as an artifact for 7 days.
• The workflow pins each action to a full commit SHA, with the release tag in a comment. A moved or compromised tag cannot change the code it runs.
• The workflow token can only read repository contents.

Verification

• actionlint passes on the workflow file.
• The workflow run on this pull request is the first test of the suite on Linux.