chore: restore GHA CI just for main branch (#3660)

Our release script expects to be able to run tests there, so we should be verifying that each commit is releasable

.github/workflows/ci.yaml

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
new file mode 100644
index 0000000..a5fb2e2
--- /dev/null
+++ b/.github/workflows/ci.yaml
@@ -0,0 +1,15 @@
+name: CI
+
+# Controls when the action will run.
+on:
+  # Triggers the workflow only for the main branch (no need to duplicate Buildkite)
+  push:
+    branches: [main]
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+jobs:
+  test:
+    uses: bazel-contrib/.github/.github/workflows/bazel.yaml@v2
+    with:
+      folders: '["."]'

.github/workflows/release_prep.sh

diff --git a/.github/workflows/release_prep.sh b/.github/workflows/release_prep.sh
old mode 100644
new mode 100755