feat: Phase 0 Sealing - GitHub Actions CI pipeline

Added automated testing workflow for Rust CLI and Lean 4 proofs:

Rust CLI Job (ubuntu-latest):
- Check formatting with cargo fmt --check
- Run clippy with -D warnings (fail on any warnings)
- Run all test suites separately (unit, integration, property)
- Build release binary and verify it works
- Cache dependencies with Swatinem/rust-cache

Lean 4 Job (ubuntu-latest):
- Install Lean 4 via elan (v4.12.0)
- Build all proofs with lake build
- Check for sorry placeholders (track proof completeness)

Features:
- Triggers on push/PR to impl/rust-cli/** or proofs/lean4/**
- SHA-pinned actions following OpenSSF best practices
- Separate jobs for Rust and Lean (parallel execution)
- All test types run separately for clear failure reporting

Actions used (all SHA-pinned):
- actions/checkout@b4ffde65 (v4)
- dtolnay/rust-toolchain@6d98179 (stable)
- Swatinem/rust-cache@ad39774 (v2)

Phase 0 Sealing: Component 5/6 complete

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: Test

.github/workflows/rust-cli.yml

@@ -0,0 +1,92 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+name: Rust CLI Tests
+
+on:
+  push:
+    paths:
+      - 'impl/rust-cli/**'
+      - 'proofs/lean4/**'
+      - '.github/workflows/rust-cli.yml'
+  pull_request:
+    paths:
+      - 'impl/rust-cli/**'
+      - 'proofs/lean4/**'
+
+permissions: read-all
+
+jobs:
+  test:
+    name: Test Rust CLI
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@6d9817901c499d6b02debbb57edb38d33daa680b  # stable
+        with:
+          components: rustfmt, clippy
+
+      - name: Cache Rust dependencies
+        uses: Swatinem/rust-cache@ad397744b0d591a723ab90405b7247fac0e6b8db  # v2
+        with:
+          workspaces: impl/rust-cli
+
+      - name: Check formatting
+        working-directory: impl/rust-cli
+        run: cargo fmt --check
+
+      - name: Run clippy
+        working-directory: impl/rust-cli
+        run: cargo clippy --all-targets --all-features -- -D warnings
+
+      - name: Run unit tests
+        working-directory: impl/rust-cli
+        run: cargo test --lib --verbose
+
+      - name: Run integration tests
+        working-directory: impl/rust-cli
+        run: cargo test --test integration_test --verbose
+
+      - name: Run property tests
+        working-directory: impl/rust-cli
+        run: cargo test --test property_tests --verbose
+
+      - name: Build release binary
+        working-directory: impl/rust-cli
+        run: cargo build --release
+
+      - name: Verify binary works
+        working-directory: impl/rust-cli
+        run: |
+          ./target/release/vsh --version
+          echo "mkdir test_ci" | ./target/release/vsh
+
+  lean4:
+    name: Verify Lean 4 Proofs
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4
+
+      - name: Install Lean 4
+        run: |
+          curl -sSf https://raw.githubusercontent.com/leanprover/elan/master/elan-init.sh | sh -s -- -y --default-toolchain leanprover/lean4:v4.12.0
+          echo "$HOME/.elan/bin" >> $GITHUB_PATH
+
+      - name: Verify elan installation
+        run: |
+          lean --version
+          lake --version
+
+      - name: Build Lean proofs
+        working-directory: proofs/lean4
+        run: lake build
+
+      - name: Check for proof completeness
+        working-directory: proofs/lean4
+        run: |
+          # Count sorry placeholders (should be minimal)
+          SORRY_COUNT=$(grep -r "sorry" *.lean | wc -l || echo "0")
+          echo "Found $SORRY_COUNT sorry placeholders in proofs"
+          # Note: Some sorry placeholders are expected during development