Add CI/CD pipeline for code quality and compliance #44

As the project grows and takes on more contributors, we should establish
automated CI/CD checks to enforce code quality and legal compliance on
every PR.

Proposed checks

1. Code formatting

Enforce consistent style using ruff (linter + formatter) in two places:

• GitHub Action — runs on every PR touching .py or .json files, blocks merge if checks fail.
• Pre-commit hook — same checks run locally on every git commit (see item 5).

2. Automated testing

Run the test suite on every PR. Given the hardware requirements (some
tests need a GPU), a practical split:

• CPU tests (tests/unit/, tests/hf/, tests/composer/) on standard
  ubuntu runners
• GPU tests (tests/vllm/, tests/integration/) on self-hosted GPU
  runners (or triggered manually / on merge)

3. DCO sign-off

Require a Signed-off-by trailer on every commit (Developer Certificate
of Origin). Enforced via a GitHub Action that blocks merging if any commit
in the PR is missing the sign-off. Contributors sign off with:
git commit -s

4. SPDX license headers

Verify that all source files carry the correct SPDX header:
# SPDX-License-Identifier: Apache-2.0
The project already uses this convention. A pre-commit hook or dedicated
CI step can enforce it on new files.

5. Pre-commit hooks

Ship a .pre-commit-config.yaml so contributors can run the same checks
locally before pushing. Install once with:
uvx pre-commit install
After that, formatting and linting run automatically on every git commit,
catching issues before they reach CI.

Notes

• CPU tests can run on every PR; GPU tests can be gated to merge or
  run on self-hosted runners.
• DCO is a lightweight alternative to a full CLA and is standard in
  Apache-licensed open source projects.
• Pre-commit hooks and CI checks should mirror each other so local and
  remote validation are consistent.