Add Spindle CI workflow
Runs tests with coverage on push/PR to main, using the free
spindle.tangled.sh instance. This mirrors what the pre-commit hooks
already enforce locally — just making sure it's gated in CI too.
Docker build + push to ATCR is a follow-up once we sort out the
auth model there.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>