ci: restored required pull request checks

.github/workflows/pr.yml

@@ -0,0 +1,30 @@
+name: PR checks
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pr-checks-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  build-vet-test:
+    name: Build, vet and race tests
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
+      - run: go build ./...
+      - run: go vet ./...
+      - run: go test -race -count=1 ./...

CONTRIBUTING.md

@@ -43,6 +43,10 @@ Types: `feat`, `fix`, `refactor`, `docs`, `test`, `chore`, `perf`, `ci`
 
 ## CI Gates
 
+Every pull request into `main` runs the required **Build, vet and race tests** check on Linux ARM64, using the Go version declared in `go.mod`. Superseded runs are cancelled. The branch must be up to date with `main` before merging.
+
+Packaging, installed-client and native platform validation remain available through the manual **CI** workflow. Release publication remains manual through **Release**.
+
 All checks must pass before merge:
 
 ```bash

cmd/cq/release_provenance_test.go

@@ -442,7 +442,7 @@ func TestCICoversSupportedNativePlatforms(t *testing.T) {
 	}
 }
 
-func TestGitHubWorkflowsRunOnlyWhenDispatched(t *testing.T) {
+func TestNativeValidationAndReleaseRequireDispatch(t *testing.T) {
 	for _, path := range []string{
 		"../../.github/workflows/ci.yml",
 		"../../.github/workflows/release.yml",