CI design gate: run ss-score + deterministic checks on pull requests

[bitjaru]

From ROADMAP.md — Now.

Run ss-score and the deterministic checks (validate-engine, validate-palettes, skill-contract checks) on PRs and attach the score plus named deductions as a check run. A design regression should fail CI the same way a broken test does.

Acceptance:

• GitHub Action workflow that scores changed artifacts on PR
• Check run output lists per-category score and named deductions
• Fails below the project lock's threshold (default 80)
• Dogfooded on this repository's own artifacts first