Run the tests in CI as a merge gate

.github/workflows/test.yml

@@ -0,0 +1,24 @@
+name: Tests
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: vet + fmt + tests
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - name: Latest supported Go
+        run: docker compose run --rm ci
+      - name: Lowest supported Go
+        env:
+          GO_VERSION: 1.22.12
+        run: docker compose run --rm ci

README.md

@@ -399,13 +399,15 @@ docker compose run --rm --user "$(id -u):$(id -g)" fmt   # gofmt -w .
 docker compose run --rm --user "$(id -u):$(id -g)" tidy  # go mod tidy
 ```
 
-`docker build .` runs `go vet` and the tests, so it works as a CI gate too.
+Every pull request runs `docker compose run --rm ci` against both the latest and
+the lowest supported Go, and must pass before it can be merged. `docker build .`
+runs the same vet and tests locally.
 
 Tests run against the latest Go by default. Set `GO_VERSION` to check the lowest
 supported version too:
 
 ```sh
-GO_VERSION=1.22 docker compose run --rm test   # lowest supported
+GO_VERSION=1.22.12 docker compose run --rm test   # lowest supported
 docker compose run --rm test                      # latest
 ```