ci: run the unit tests, and align the ruff pin with CI (#84)

## Unit tests were never executed (#73)

`lint.yml` delegates to the skill-repo-skill reusable, whose steps are
skill validation, manifest sync, markdownlint, yamllint, actionlint,
shellcheck, ruff and checkpoint schemas. Ruff parses the test files.
Nothing runs them.

Both suites — `_lib/test_formatting.py` and
`scripts/test_matrix_doctor.py`, 54 tests between them — have been
passing locally and proving nothing about any pull request.

The job runs each test file directly instead of using discovery, and
that is deliberate:

```
$ python3 -m unittest discover -s skills -p 'test_*.py'
Ran 0 tests in 0.000s
NO TESTS RAN
$ echo $?
0
```

The skill directories are not importable packages (hyphens in the
names), so discovery rooted above `scripts/` collects nothing and exits
0 while doing it. A discovery-based job would have gone green without
running a test — the same failure mode as the bug it is meant to catch.
The job therefore also fails a file that reports `Ran 0 tests`.

Verified locally against both suites:

```
--- skills/matrix-communication/scripts        Ran 34 tests   OK
--- skills/matrix-communication/scripts/_lib   Ran 20 tests   OK
```

Stdlib only, so the job needs no dependency install.

## ruff pin drift (#75)

`.pre-commit-config.yaml` pinned `ruff-pre-commit` at v0.15.14 while the
reusable CI workflow runs `uvx --no-build ruff@0.16.0`. `ISC004` does
not exist in the older one, so a commit passed the hook and failed CI —
that happened on #74 in this repo.

Bumped to v0.16.0, with a comment naming the coupling. This aligns the
two today; it does not enforce the pairing, because the CI version lives
in `netresearch/skill-repo-skill` behind its own `# renovate:` comment
and Renovate bumps each side independently. #75 keeps the structural
question open.

## Not addressed

The repo header states a CI/Hook Parity Principle — "every hook below
ALSO runs in CI". The reverse now holds too, in the sense that this job
has no hook counterpart: tests do not run on commit. That is deliberate
(a pre-commit hook running the suites would slow every commit for a repo
whose tests are this cheap to run in CI), but it is worth naming rather
than leaving as an inconsistency someone finds later.

Author: CybotTM

.github/workflows/tests.yml

@@ -0,0 +1,69 @@
+name: Unit Tests
+
+# Nothing else in CI executes the test files. The lint workflow parses them with
+# ruff, which proves they are syntactically valid Python and nothing more - a
+# change that breaks the code under test ships green without this job.
+#
+# The suites are stdlib `unittest` and are run by path, not by discovery:
+# `unittest discover` rooted above the scripts directory finds nothing (the skill
+# directories are not importable packages - hyphens in the names) and still exits
+# 0, so a discovery-based job would report success while running no tests. Each
+# file is executed directly, the way its own docstring documents, and the run
+# fails if a file reports zero tests.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions: {}
+
+jobs:
+  unittest:
+    name: Unit Tests
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # The job only reads the tree. Leaving the token in .git/config would
+          # hand it to anything the tests execute.
+          persist-credentials: false
+
+      - name: Run test suites
+        run: |
+          set -uo pipefail
+          mapfile -t files < <(find skills -type f -name 'test_*.py' | sort)
+
+          if [[ ${#files[@]} -eq 0 ]]; then
+            echo "::error::No test files found under skills/"
+            exit 1
+          fi
+
+          echo "Found ${#files[@]} test file(s)"
+          status=0
+
+          for f in "${files[@]}"; do
+            echo "::group::$f"
+            output=$(python3 "$f" -v 2>&1)
+            rc=$?
+            echo "$output"
+            echo "::endgroup::"
+
+            if [[ $rc -ne 0 ]]; then
+              echo "::error file=$f::test suite failed"
+              status=1
+            elif grep -q "^Ran 0 tests" <<<"$output"; then
+              echo "::error file=$f::collected no tests"
+              status=1
+            fi
+          done
+
+          exit $status

.pre-commit-config.yaml

@@ -49,8 +49,12 @@ repos:
     hooks:
       - id: actionlint
 
+  # Keep this rev on the same ruff version the reusable validate.yml runs
+  # (`uvx --no-build ruff@X.Y.Z`). The two pins are in different repositories and
+  # nothing enforces the pairing, so a hook older than CI passes locally and
+  # fails in CI on rules the older ruff does not have yet. See issue #75.
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.14
+    rev: v0.16.0
     hooks:
       - id: ruff
       - id: ruff-format