Allow manual CI runs and restrict job permissions

[yfaming]

Motivation

• Add a CI workflow to validate formatting, linting, and tests on push to main, pull_request, and manual runs, while limiting job permissions to the least required.

Description

• Add .github/workflows/ci.yml which triggers on push to main, pull_request, and workflow_dispatch, defines a rust job running on ubuntu-latest with permissions: contents: read, and runs steps to checkout, install the Rust toolchain with rustfmt and clippy, cache Cargo, run cargo fmt --all -- --check, run cargo clippy --all-targets --all-features -- -D warnings, and run cargo test --all-targets --all-features.

Testing

• No automated tests were executed as part of this change; the workflow will run on CI when triggered by push/pull_request or manual workflow_dispatch.

---

Codex Task