chore: adopt the standard CI shape, CodeQL and Dependabot

[StuartMeeks]

What changed

PR A of the NextIteration.Standards adoption sequence — CI and verification. Closes §3.0, §3.1, §3.5, §3.6, §3.7, §4.4 and §4.6 for this repo. §2.3 was already met.

• ci.yml replaced with the canonical template. build and test split, test runs a three-platform matrix, and a new aggregating ci gate is the intended single required status check. Adds concurrency, timeout-minutes, a least-privilege permissions block and a NuGet cache. Coverage is now actually invoked (-- --coverage) and uploaded per platform.
• codeql.yml added (security-and-quality, weekly + per push/PR).
• dependabot.yml and dependabot-auto-merge.yml added. Minor/patch grouped and auto-merged behind CI; majors stay open.
• AtomicFile Windows fix — see below.

Why

Two repo-specific decisions worth calling out:

The release job is kept. §3.1 names four canonical jobs and does not forbid a fifth. This repo's release job cuts the GitHub release from CHANGELOG.md; deleting it would remove working behaviour that no clause objects to. It now sits downstream of publish, so a release is only ever cut for bytes that reached nuget.org, and it is tag-gated so it can never run on a PR.

No platform exception is claimed. §3.1.1 makes all three platforms the default. This library has no OS-native backend, but it is a filesystem library — AtomicFile's replace primitive genuinely differs by platform, which is precisely the point.

dependabot.yml's ignore list has one entry, not Auth's three. §4.10 defines it as the packages this repo floors per TFM, and this repo floors exactly one. Copying the template verbatim would assert two dependencies that are not in the tree.

Consumer impact

AtomicFile raised a sharing violation on Windows. File.Move(overwrite: true) is rename(2) on POSIX, which replaces a destination another handle holds open and serialises concurrent renames. On Windows the same call is MoveFileEx, which does neither: it throws when the destination is open or when two replacements race. WriteAllTextAsync now routes Windows through File.Replace (ReplaceFile) with a short retry for the window between testing for the destination and replacing it — the same fix Auth needed.

This has shipped since 0.1.0 and was never caught, because the concurrent-writer test had only ever run on Linux. It is a pre-existing defect surfaced by the new matrix leg, not a regression, and per ADOPTING.md it is fixed in the same PR so the branch stays green.

No public API, target framework, dependency floor or on-disk format change.

Checklist

• Build is clean — no new warnings (TreatWarningsAsErrors is on)
• Tests pass on every shipped target framework — 64/64 on net8.0 and net10.0 locally; Windows and macOS run here for the first time
• Public API changes carry XML docs — none; AtomicFile is internal and its remarks are updated
• CHANGELOG.md updated under [Unreleased]
• Dependency floors unchanged

🤖 Generated with Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.