ci: add required PR baseline and nightly determinism workflows (#66)

[senolcolak]

Summary

Second PR of the testing-foundation series: the mandatory pull-request CI baseline, before the expensive system-test work in later issues.

Closes #66.

Stacked on #79 (#67). Base branch is feat/67-hermetic-test-foundation because this workflow calls the hermetic make targets introduced there (test-unit, test-envtest, test-unit-repeat). Merge #79 first, then this rebases onto main. The diff below is scoped to this PR's own changes.

What's added

.github/workflows/ci.yaml — required fast checks, all SHA-pinned, permissions: contents: read, concurrency-cancel on superseded runs, 15-minute per-job timeout:

• generated files up to date — make gen && make helm && make imports must be a no-op (guards controller-gen CRDs/RBAC/deepcopy and the Helm chart templates they feed).
• fmt / vet / lint / unit / build — gofmt, go vet, golangci-lint, unit tests (-race -shuffle=on), go build.
• envtest integration — controller suite against the pinned Rook CRD (no network); uploads logs on failure.
• helm lint + template — chart lints and renders.
• govulncheck.

.github/workflows/nightly.yaml — the 20× determinism repeat, deferred off the required gate to keep fast CI under target.

contrib/k8s/3rdparty/rook.yaml — vendored, pinned Rook v1.18.6 CRD, verified byte-for-byte identical to the upstream tag. Un-ignored just this file in .gitignore; added an Apache-2.0 REUSE annotation (Rook's license). This makes the CRD/envtest jobs network-free.

docs/ci/required-checks.md — the checks branch protection must require, plus recommended main settings (supports #77).

Design notes

• CI reads the Go version from go.mod and the K8s/envtest version from the Makefile, so it uses the versions the repo declares.
• All Go tooling runs via go tool X (declared in go.mod), resolved and cached by actions/setup-go — no separate installs, no version drift.

Verification

• Both workflow files parse as valid YAML.
• make gen && make helm && make imports is a no-op on the committed tree (the generate job passes on a clean checkout).
• helm lint and helm template both succeed; gofmt clean.
• reuse lint passes 77/77 files including the vendored CRD.
• Rook CRD sha256 matches upstream v1.18.6 (ae93e5d8…).

Review

Reviewed for Actions correctness/security: SHA-pinned, least-privilege, no pull_request_target, hermetic. One gap found and fixed — the generate job now also runs make helm so stale chart templates can't slip through green CI.