CI: quality gates (coverage threshold, mypy, ruff, bandit) per PR

[wimaan3]

Context

Enforce the quality bar on every PR.

Acceptance criteria

• CI runs ruff + mypy + pytest with coverage; coverage threshold enforced.
• bandit static analysis runs.
• These checks required for merge (ties to branch protection).