ci: add self-hosted CI workflow and raise test coverage

[luthermonson]

Summary

Adds full CI for switchboard on the ephpm org's ephemerd self-hosted fleet, and raises unit-test coverage from 48 to 79 tests.

CI (.github/workflows/ci.yml)

Runs on [self-hosted, linux, x64] (same label ephpm/ephpm uses, so the fleet picks it up). Triggers: push to main, PRs to [main, "feat/**"]. Jobs:

• fmt — cargo fmt --all -- --check on stable (no rustfmt.toml, so no nightly-only options; nightly is unnecessary here).
• clippy — cargo clippy --all-targets -- -D warnings.
• test — cargo test.
• msrv — cargo check --all-targets pinned to the declared rust-version = 1.85.

Pure Rust: no PHP, no SDK, no Docker.

Coverage (+31 tests)

Real behavior assertions over pure/testable logic only (no live-network or running-server tests):

• config.rs (new module): clap defaults, explicit-flag overrides, missing-required-arg and non-numeric app_id rejection.
• main.rs (new module): base64_url_encode — padding-free, URL-safe alphabet (-/_, never +//), decode round-trip.
• github.rs: extracted the teardown comment body into a pure teardown_comment_body() fn so it's testable; added marker/table-structure, one-decimal duration rounding, and all-framework label coverage.
• deployer.rs: dotenv quoting/escaping, preview_url non-8.x and arbitrary-8.x-minor edges, Symfony/Drupal detection + WordPress precedence, teardown removes the dir / is-ok-when-absent.
• manifest.rs: Symfony/Drupal framework defaults, database: none / case-insensitive turso, explicit websocket, legacy-json default preservation.
• secrets.rs: multiple refs in one string, repo→default fallback, empty env-suffix skip.

Local (WSL, shared warm target): fmt clean, clippy clean, 79/79 tests pass, MSRV 1.85 check passes.