ci: run cargo-semver-checks on PRs targeting main (#1660)

Co-authored-by: Claude <noreply@anthropic.com>

Author: kixelated

.github/workflows/semver.yml

@@ -0,0 +1,48 @@
+name: Semver
+
+permissions:
+  id-token: write
+  contents: read
+
+# Informational only: cargo-semver-checks flags accidental breaking changes
+# against the crates.io baseline. Scoped to PRs targeting main, since wire and
+# API breakage lands on dev where bumps are expected. This is not a required
+# check; a red result is a heads-up to bump the version, not a merge blocker.
+on:
+  pull_request:
+    branches: [main]
+
+# Cancel in-flight runs when a new commit lands on the same PR.
+concurrency:
+  group: semver-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  semver:
+    name: Semver
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Free disk space
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # main
+        with:
+          tool-cache: false
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - uses: DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f # main
+        with:
+          determinate: false
+      - uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # main
+      - uses: DeterminateSystems/flake-checker-action@89c01715e5d0dfdc0a1bfe9d59891ee4945c1483 # main
+
+      # Cache Rust dependencies and build artifacts
+      - name: Rust Cache
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        with:
+          cache-on-failure: true
+
+      - run: nix develop --command just rs semver