chore: adopt the standard CI shape and fold release.yml into ci.yml

[StuartMeeks]

What changed

Adopts the canonical CI shape from NextIteration.Standards — §3.0, §3.1, §3.5, §3.6, §3.7, §4.4, §4.6. Copied from NextIteration.SpectreConsole.Auth, the 25/25 reference implementation, rather than re-derived.

• release.yml folded into ci.yml (§3.0). publish now downloads the artifact this run's build job produced, so the bytes pushed to nuget.org are the bytes the gate tested. The tag-triggered workflow rebuilt from the tag and published an artifact no gate had ever seen.
• New aggregating gate job ci (§3.1), needs: [build, test], if: always(), failing on any upstream result that is not success — skipped included.
• concurrency + cancel-in-progress (§3.5, never on tags), per-job timeout-minutes (§3.6), NuGet restore cache (§3.7).
• codeql.yml added (§4.4) — security-and-quality, explicit build rather than autobuild.
• dependabot-auto-merge.yml added (§4.7/§4.8) — minor+patch only, queued behind ci.
• .github/dependabot.yml rewritten (§4.6/§4.10).

Why

Two of these fix live defects rather than merely conforming:

1. The old artifact upload globbed *.nupkg. The .snupkg was packed on every release and then silently never published. The glob is now *nupkg.
2. build and test were required status checks directly. test is a matrix, so its check names carry the matrix values — editing the platform list breaks branch protection. The ci gate's name never changes, so build and test can be renamed, split or re-platformed freely.

if: always() on the gate is load-bearing. Without it the gate is skipped when an upstream job fails, and branch protection reads a skipped check as satisfied — it would pass precisely when it must fail.

Sequencing — two things outside this diff

• nuget.org Trusted Publishing policy repointed from release.yml to ci.yml. The policy binds to a workflow filename; without this the next publish fails to authenticate. Being done before this merges.
• Required status check → [ci]. Cannot be set before this PR reports a ci check. Once ci is green here, apply-repo-settings.sh --repo NextIteration.SpectreConsole.SelfUpdate --with-required-checks sets it and this PR becomes mergeable. Per ADOPTING.md, no interim relaxation to [build] is needed — pull_request runs the workflow from the PR's own head, so the PR that adds ci reports ci.

Checklist

• Build is clean — no new warnings (TreatWarningsAsErrors is on)
• Tests pass on every shipped target framework — 392 tests, 196 × net8.0/net10.0, verified locally before this branch
• Public API changes carry XML docs — n/a, no code change
• CHANGELOG.md updated under [Unreleased]
• Dependency floors unchanged

Consumer impact

None. No change to the library, its public surface, or the package contents. <Version> is untouched and no tag is pushed, so nothing publishes.

🤖 Generated with Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.