ci: add GitHub Actions workflow across os and node matrix

[agalwood]

What

Adds .github/workflows/ci.yml — the repo's first CI. On every push to main, every PR targeting main, and manual workflow_dispatch, it runs the four gates in order:

pnpm lint → pnpm typecheck → pnpm test → pnpm build

across a 3×3 matrix: ubuntu-latest / windows-latest / macos-latest × Node 20 / 22 / 24, with fail-fast: false so one failing combo doesn't mask the others. Getting the matrix green also required one real product fix and a set of test-portability fixes (below).

Why windows is in the matrix

The self-update win32 code in src/run-command.ts (cross-spawn-style cmd.exe escaping, absolute-path taskkill, exit-code command-not-found normalization) only executes on win32 — the windows runners are the only place it actually runs. This paid off immediately: the first windows run caught a real bug (see below).

What the first runs caught

1. node 20 × pnpm 11: pnpm 11.13.0 refuses to run on node < 22.13, and both pnpm/action-setup standalone mode and npm i -g @pnpm/exe are broken for 11.13.0 — the @pnpm/* platform packages on npm were published without their binary (Error after installing in standalone mode when trying to install packages with a CLI globally - This: not found pnpm/action-setup#277). The workflow instead downloads the standalone binary straight from the pnpm GitHub release (a separate, intact pipeline), versioned by the packageManager field. pnpm runs on its own bundled runtime; the gates run on the matrix node.
2. CRLF: windows runners check out with core.autocrlf=true, failing biome check (repo pins lineEnding: lf). Fixed at the git layer with .gitattributes (* text=auto eol=lf).
3. Real win32 bug in run-command.ts: looksLikeBatchShim treated every extensionless bare name as a .cmd shim, so node arguments got the double meta-escape. cmd.exe parses an .exe command line only once, so literal carets reached node's argv and node -e <script> broke outright. Now only the JS package managers invoked by bare name (npm/npx/pnpm/pnpx/yarn/corepack — actual .cmd shims) get the double escape; the BatBadBut mitigation for them is unchanged.
4. POSIX assumptions in tests: hardcoded / in path expectations (now join()-built so the platform-selection logic stays covered on every host), 0o600 mode assertions (windows has no POSIX mode bits — skipped there), and spawn-failure/timeout semantics (win32 goes through cmd.exe: missing command = non-zero exit + "is not recognized" stderr, not spawn ENOENT; taskkill = non-zero code, not signal null).

Known pre-existing limitation, unchanged by this PR: a standalone pnpm.exe invoked as bare pnpm still gets double-escaped (caret-mangled) args on win32 — it fails loudly, and resolving the real extension via PATHEXT (as cross-spawn does) is the complete future fix.

Design notes

• Top-level permissions: contents: read (least privilege) and persist-credentials: false on checkout — no step needs the token after clone.
• concurrency keyed by workflow + ref cancels superseded runs.
• CI only: no publish workflow, no NPM_TOKEN or other secrets. Publishing stays manual pnpm publish + OTP.

Test plan

• All four gates pass locally on macOS (217/217 tests) with pnpm install --frozen-lockfile.
• All 9 matrix combos green on this PR's Checks tab, including the three windows jobs which now exercise the win32 self-update path for the first time.