ci: clang-tidy job #30

Goal

CI runs clang-tidy, so the checks of .clang-tidy, including the naming convention (docs/naming.md), are enforced on every PR instead of only locally.

Scope

• A clang-tidy job in .github/workflows/ci.yml: configure a Linux preset (compile_commands.json), then run clang-tidy (LLVM 23, same version as the clang-format job) on the first-party sources and tests, never on extern/ or generated files.
• The job fails on any warning (--warnings-as-errors=* or equivalent), without editing .clang-tidy.
• Reuse the vcpkg binary cache of the build jobs.
• Update the cpp-lint skill if the CI command differs from it.

How to verify

• The job is green on a PR into dev with the current code.
• A deliberately misnamed identifier (e.g. a private member without m_) turns it red (shown once in the PR description, then reverted).

Dependencies

#26 (Ubuntu 26.04 runners), #29 (naming checks in .clang-tidy).

Suggested model

sonnet