[DTOSS-12157] - feat: implement automated release pipeline with CI/CD optimisation

[josielsouzanordcloud]

Description

• Automated release pipeline — semantic-release detects version bumps from conventional commits, creates git tags, and triggers GitHub Releases with build artifacts
• CI/CD optimisation — pipeline reduced from ~4min to ~1m40s by replacing Docker-based semantic-release with CLI and moving CodeQL to a dedicated workflow
• Windows deployment suite — PowerShell scripts for deploy, rollback, and cleanup of Windows Service-based installations
• Deployment documentation — runbooks for deploy/rollback/cleanup operations and a deploy script analysis document

Jira link

DTOSS-12157

Changes

CI/CD Pipeline

• Add cicd-2-main-branch.yaml pipeline: commit → test → release → build stages
• Add CLI-based semantic-release version detection and tag creation
• Move CodeQL analysis from commit stage to dedicated codeql.yaml (PRs + weekly schedule)
• Fix GitHub Release asset upload by passing new_release_published as explicit input to reusable build workflow
• Add build packaging with package_release.sh, smoke test, and provenance attestation
• Add gitleaks secret scanning and Dependabot configuration

Deployment

• Add scripts/powershell/deploy.ps1 — Windows Service deployment with health checks
• Add scripts/powershell/rollback.ps1 — versioned rollback with automatic backup restoration
• Add scripts/powershell/cleanup.ps1 — retention-based cleanup of old deployment artifacts
• Add deployment runbooks and analysis documentation

Review checklist

• Check database queries are correctly scoped to current_provider

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[carlosmartinez]

@steventux and I looked through this, seems solid! although we weren't able to check every line of powershell haha