Formalize contract tests

[agustin-littlehat]

Summary

• make the committed test/ folder intentional by removing it from .gitignore
• add the missing test/importTsModule.mjs helper used by the contract tests
• add a minimal committed scripts/testContracts.mjs entrypoint so pnpm test works from a clean clone without pulling in local smoke/oracle scripts
• trim package scripts that pointed at ignored local-only harnesses
• whitelist the public test entrypoint while keeping other local scripts ignored
• commit pnpm-lock.yaml for reproducible public installs
• gate the local debug site behind CSSQUAKE_LOCAL_DEBUG_SITE=1 and remove personal capture path fallbacks
• add a minimal GitHub Actions CI for install, tests, and build
• remove the tracked third-party id Software logo asset/link; README still credits and links the Quake source

Baseline

• clean origin/main failed pnpm test before edits because scripts/testContracts.mjs was referenced by package.json but absent from the committed tree

Validation

• pnpm install --frozen-lockfile
• node --test test/*.test.mjs
• pnpm test
• pnpm build
• git diff --check
• git diff --cached --check before commits
• git ls-files -ci --exclude-standard
• git grep -n -I /Users/\|ekrof

Supersedes #9.