ci(workflows): add PR-tests workflow running dotnet test

[kirill-abblix]

Summary

Closes a real CI gap — Oidc.Server has only CodeQL static-analysis on PRs; tests have never run in CI. Reviewers had no GitHub-visible proof tests pass.

Workflow mirrors Abblix/Kezio/.github/workflows/pr-tests.yml and Abblix/AuthenticationService/.github/workflows/pr-validation.yml:

• All uses: pinned to commit SHAs with version comments (per github-actions-security-checklist § Action pinning).
• Top-level permissions: contents: read; persist-credentials: false on checkout to drop the GITHUB_TOKEN git credential after fetch.
• concurrency: cancel-in-progress: true — fresh push aborts stale runs.
• timeout-minutes: 20 — bounded runtime.
• Installs SDK 8/9/10 (library projects multi-target); tests execute on net10.
• MTP-native test invocation (xunit.v3 + Microsoft.Testing.Platform) — VSTest flags would be silently ignored.

actionlint clean.

Test plan

• actionlint .github/workflows/pr-tests.yml — no issues.
• Workflow run on this PR itself (GitHub picks it up from head ref when workflow file is added in PR).

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[kirill-abblix]

Post-merge note (2026-04-29): rolled back from master.

This PR was created against master by mistake — it should have targeted develop. After merge I caught the Git Flow violation and reset master to the pre-session tip (71dd981) via git push --force-with-lease.

Unlike #68, the content of this PR is not preserved on develop: develop already had its own pr-tests.yml (added in commit 34a5e37 long before this PR) running dotnet test on every PR, and the subsequent master → develop merge resolved that conflict in favour of develop's pre-existing version. So my version of pr-tests.yml was a duplicate effort I didn't notice — its loss costs nothing because develop's variant already does the same job.

Net state:

• master tip: 71dd981 — no pr-tests.yml (file never existed on master before today).
• develop tip: e7b9d65 — runs pr-tests.yml from 34a5e37, which already covers the validation this PR aimed to add.
• This PR remains MERGED in GitHub metadata because the API blocks changing base of a closed PR; the comment is the only way to annotate the audit trail.

Lesson: should have grepped the develop branch for an existing PR-tests workflow before authoring a new one. Codified the feature → develop base-branch rule in this repo's CLAUDE.md and in cross-repo memory (feedback-default-base-branch-develop.md).