Add PR test workflow

Run the pytest suite on pull requests to master across Python 3.9, 3.11
and 3.13 (the last exercises the legacy-cgi backport), installing
dependencies with Poetry. Actions are pinned to commit SHAs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -0,0 +1,36 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [ master ]
+
+jobs:
+  test:
+    name: Unit tests (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # 3.9/3.11 use the stdlib `cgi` module; 3.13 has it removed, so this
+        # also exercises the `legacy-cgi` backport that the manifest pulls in.
+        python-version: ['3.9', '3.11', '3.13']
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install Poetry
+        run: pipx install poetry
+
+      - name: Install dependencies
+        run: |
+          poetry env use python
+          poetry install --with dev
+
+      - name: Run test suite
+        run: poetry run pytest