ci: run make check on pull requests and main

[andyjsbell]

Branch: ci/run-make-check
Depends on: current main
Priority: P2 — the quality gate is not enforced anywhere.

Prompt:

make check is a serious gate — it runs cargo fmt --check, cargo clippy -D warnings, the core workspace tests, the Python bindings + LangGraph pytest suites, and recurses into the services/awp-cloud sub-workspace. But no CI workflow runs it. The only committed GitHub Actions workflow builds Python wheels. So "green" depends entirely on contributor discipline, and a regression in the Rust core, agents, or cloud service can merge unnoticed. This task adds a CI workflow that runs the full gate on every pull request and on pushes to main.

Context

• Makefile (repo root) — check: lint test check-python cloud-check. lint = cargo fmt --all --check + cargo clippy --workspace --all-targets -D warnings. test = cargo test --workspace --exclude awp-python. check-python = builds a .venv, installs maturin pytest langgraph, builds the awp-verify binary, maturin develops awp-core-py, runs the bindings + langgraph pytest suites. cloud-check recurses into services/awp-cloud's own Makefile.
• .github/workflows/python-wheels.yml — the only existing workflow (wheel build/release). Reuse its runner/toolchain setup conventions.
• services/awp-cloud is its own Cargo sub-workspace with an independent Makefile; cloud-check already drives it.
• The default make check is hermetic (Postgres/S3 integration tests skip without env), so CI needs no external services for the base gate.

Your Task

1. Add .github/workflows/ci.yml — triggers on pull_request and push to main. Steps: checkout; install a pinned Rust toolchain with rustfmt + clippy (match the repo's cargo 1.96-era toolchain); set up Python 3.x; cache cargo and the pip/venv; run make check.
2. Make it reliable — ensure the job installs everything check-python needs (a system Python that maturin/venv can use). If make check's first run is slow, add cargo + pip caching keyed on Cargo.lock and the pyproject files.
3. Required-status hint — add a short note in README.md (or CONTRIBUTING if one exists) that CI runs make check and it must be green to merge; leave actually enabling branch protection to the repo admin (call it out, don't attempt it from the workflow).

Do Not Touch

• .github/workflows/python-wheels.yml — the wheel workflow stays as-is; this is a separate CI job.
• The Makefile targets — the gate definition is correct; the job just invokes make check. Do not change what the gate runs.
• Application code — this is CI only.

Verification

make check
# → passes locally, proving the command CI will run is green on current main

# Workflow is valid and runs make check:
grep -n "make check" .github/workflows/ci.yml
# → present
# (Optional) validate with actionlint if available:
actionlint .github/workflows/ci.yml
# → no errors

# After opening the PR, the CI check appears and passes on the PR.