ci: add test + bandit + ruff workflow

Runs ruff (informational), a bandit high-severity gate (fails on shell=True etc.)
and pytest on push/PR.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: saibamo

.github/workflows/ci.yml

@@ -0,0 +1,26 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install pytest pytest-cov ruff bandit
+          pip install -e .
+      - name: Lint (ruff, informational)
+        run: ruff check .
+        continue-on-error: true
+      - name: Security gate (bandit, fails on high severity, e.g. shell=True)
+        run: bandit -r sofahutils --severity-level high
+      - name: Tests
+        run: pytest -q