Harden and simplify CI/CD pipeline

[skilledwolf]

What

Rebuild the fork's CI/CD around a small required gate, a strict scheduled compatibility sweep, and an sdist-first release pipeline.

• collapse duplicated Linux/macOS build jobs into one reusable 4-job PR / 14-job compatibility matrix
• make Boost and no--fpermissive coverage real
• cap runner concurrency and replace per-run ccache archives with bounded weekly caches
• harden apt/Boost/toolchain downloads with timeouts, retries, and checksum verification
• move package smoke testing into required CI and build release wheels from one verified sdist
• publish only from a matching GitHub Release through the protected pypi environment and OIDC
• pin every action and Docker image; add CODEOWNERS and grouped Dependabot updates
• replace the broken issue-router shell/third-party action with a permission-scoped GitHub Script workflow
• add a stable Gate check for branch protection

Why

The previous matrix looked broad but two important axes were ineffective: it passed Boost_ROOT_DIR while ALPS consumes Boost_SRC_DIR, and CMake always appended -fpermissive. Its per-run cache keys created 117 caches / 12.26 GB in under four hours, while an uncapped 39-job sweep amplified hosted-runner mirror stalls. Releases could publish from any v* tag, and PR validation did not exercise the actual sdist-to-wheel path.

Impact

PRs now spend capacity on four meaningful support-boundary builds plus one package smoke test. The weekly run is reduced to fourteen strict compatibility/canary builds. Remote compiler caches are limited to four labels, saved only on master, and rotate weekly. Manual release runs are build-only; only a published GitHub Release whose tag exactly matches project.version can request PyPI OIDC credentials.

Local verification

• actionlint -shellcheck shellcheck .github/workflows/*.yml
• shellcheck .github/scripts/*.sh
• jq empty .github/ci-matrix/*.json
• python3 -m py_compile .github/scripts/*.py
• zizmor --pedantic --no-config .github/workflows (zero findings)
• built pyalps-2.3.4b1.tar.gz, passed twine check, and enumerated cibuildwheel targets from that sdist
• git diff --check