ci(#21): minimal spec-sanity workflow

[ssilvius]

Summary

The repo had zero workflows, so every PR's head commit had zero check runs and legion pr merge refused all eight open fix-wave PRs (#736 zero-runs refusal, non-overridable by design). This adds the minimal honest check for a spec repo: bash only, no toolchain.

Acceptance criteria mapping

1. Workflow lands on main; its own PR shows a green spec-sanity run

pull_request workflows execute from the PR head for same-repo branches, so this PR self-triggers the workflow it introduces -- the green run on this PR is the proof, and the merge that follows is the first legion-sanctioned merge in the repo.
Evidence: the spec-sanity check run on this PR's head commit.

2. The eight open fix-wave PRs get runs and become mergeable

Once this lands, each open PR branch gets an empty-commit retrigger (git commit --allow-empty) so its head gains a run; pull_request workflows fire on synchronize. Performed by the spec owner in merge order immediately after this merges.
Evidence: subsequent merges of PRs #11, #14, #16, #15, #17, #19, #20, #18, #9 through legion pr merge.

Not done

• No typecheck of the example TypeScript: the examples import Cloudflare ambient types (D1Database, DurableObjectState) that need a dependency install to resolve, and inventing a package.json for a spec repo to satisfy CI is the tail wagging the dog. If the examples grow real build tooling, CI grows with them.
• No link checking or prose linting -- signal-free churn on a spec this size.

Closes #21

🤖 Generated with Claude Code