Add PR checks that don't depend on fly.io

[bard]

Task: Currently we use flyctl deploy --remote-only --build-only in .github/workflows/ci.yml both to build and to run checks, however that presupposes the presence of a FLY_API_TOKEN, which might not be there for contributed PRs.

Changes:

• Add an explicit lint + test step in the workflow that can be always run.
• Invoke flyctl for actual deployment only.

[clintjeff2]

Would love to take on this task