Add pull request validation gate

.github/workflows/pr-validation.yml

@@ -0,0 +1,53 @@
+name: PR Validation
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pr-validation-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    name: Repository validation
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Check changed files for whitespace errors
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: git diff --check "${BASE_SHA}...${HEAD_SHA}"
+
+      - name: Validate profile assets
+        run: |
+          python3 - <<'PY'
+          from pathlib import Path
+          from xml.etree import ElementTree
+
+          png_signature = b"\x89PNG\r\n\x1a\n"
+          for path in sorted(Path(".").rglob("*")):
+              if not path.is_file() or ".git" in path.parts:
+                  continue
+              suffix = path.suffix.lower()
+              if suffix == ".md":
+                  text = path.read_text(encoding="utf-8")
+                  if "\x00" in text:
+                      raise ValueError(f"NUL byte in Markdown file: {path}")
+              elif suffix == ".svg":
+                  root = ElementTree.parse(path).getroot()
+                  if root.tag.rsplit("}", 1)[-1] != "svg":
+                      raise ValueError(f"Unexpected SVG root element: {path}")
+              elif suffix == ".png":
+                  if not path.read_bytes().startswith(png_signature):
+                      raise ValueError(f"Invalid PNG signature: {path}")
+          PY