Enterprise: CI/CD pipeline and supply-chain scanning

[sorenwacker]

Part of #61 (Tier 1).

Problem. Gates (ruff, ruff-format, vulture@80, strict mypy, pytest) run only locally via pre-commit/pre-push. No CI enforcement, coverage tracking, or security scanning.

Goal. GitHub Actions running the same gates on every PR + coverage report + Dependabot + SAST/dependency scan + SBOM + automated, signed releases.

Acceptance. PRs blocked on red gates; coverage published; vulnerable deps flagged; releases reproducible.

[sorenwacker]

Decision (owner, 260731): fast subset on PRs, full suite on release.

The acceptance clause 'PRs blocked on red gates' is kept, but satisfied cheaply: pull requests run ruff, mypy and the fast test selection; tags keep the full suite, selenium, pip-audit, the fresh-install smoke gate and publish. This also fixes a live inconsistency — branch protection requires a 'test' context that currently never reports, because ci.yml triggers only on tags and the test job is skipped on tags.

Remaining supply-chain items in this issue (Dependabot config, SBOM, SAST beyond ruff's flake8-bandit rules, publish attestations) are unaffected by this decision and stay open here.