ci: add GitHub Actions CI, release, and PR checks

[Dhirenderchoudhary]

Summary

Adds the CI/CD pipeline from #52 so PRs to main cannot land untyped, unlinted, or untested code.

This PR is CI/docs only. Formatting lives in a separate PR (style/apply-prettier) so review stays focused.

CI (every PR + push to main)

• Quality job (Node 22): Prettier, ESLint, tsc via pnpm run build
• Test job: Vitest on Node 18, 20, 22, 24 (fail-fast: false)
• Coverage: pnpm run test:coverage on Node 22, uploaded as a coverage artifact
• Aggregator job CI: one required check for branch protection (quality + test must both succeed)
• pnpm from packageManager, --frozen-lockfile, store cache
• Concurrency cancels stale runs on the same ref
• Default contents: read; checkout uses persist-credentials: false
• Actions pinned to commit SHAs (Dependabot can bump them from the version comments)

CD

• Release: GitHub Release (or workflow_dispatch) publishes to npm with --provenance
• Needs repo secret NPM_TOKEN (automation token with publish access to passmark)

Also in this PR

• Conventional PR title check (feat / fix / docs / style / ci / …)
• PR template with the local check list
• CodeQL on PRs, pushes to main, and a weekly cron
• Dependabot: weekly GitHub Actions (grouped) + npm (max 5 open PRs)
• CI badge in README
• CONTRIBUTING: pnpm, the same commands CI runs, PR title prefixes, how npm publish works
• .gitignore: coverage, .pnpm-store

Not in this PR (on purpose)

• Live Playwright + API-key jobs. src/__tests__/integration/* is mocked and already runs in Vitest. Fork PRs never get secrets; a live E2E job can be added later, gated on push to main.
• Source formatting. Separate PR so this diff stays 11 files.

Merge order

1. Merge the Prettier PR first (style/apply-prettier).
2. Then merge this one (rebase if format:check is red — it checks the existing tree).
3. CHANGELOG.md currently conflicts with main — keep both Unreleased bullets; ours is the GitHub Actions CI/CD line.

After merge

• Require the CI status check on main (the aggregator job, not every matrix cell).
• Set NPM_TOKEN before the first GitHub Release.

Closes #52

Test plan

• pnpm run lint — 0 errors (existing warnings only)
• pnpm run build
• pnpm test — 12 files, 155 tests
• YAML for all workflows + Dependabot + composite action parses
• After Prettier PR is in: pnpm run format:check on this branch
• GitHub Actions run on this PR (quality + Node matrix + aggregator)