Runs `tools/security/check-staged.sh ci` on every push to main
and every PR. Same script as the local pre-commit hook so the gate
is identical whether or not a contributor activated the local
hook via `bash tools/install-hooks.sh`. No Flutter / Dart toolchain
needed in the runner — the check is plain bash + git.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
