ci: harden all workflows against CI best practices checklist

[SebTardif]

Summary

Systematically closes all gaps identified by comparing the CI pipeline against our CI skills checklist (ci-workflow-hygiene, ci-workflow-structure, ci-github-actions-gotchas).

Changes

Security hardening

• Add step-security/harden-runner@v2.12.0 as first step in all 17 jobs across 11 workflows (egress-policy: audit)
• Fix github.actor (unreliable) to github.event.pull_request.user.login in auto-approve, dependabot-auto-merge, and pr-title workflows
• Move stale.yml write permissions from workflow level to job level (principle of least privilege)
• Add CodeQL analysis to ruleset required status checks

Merge queue readiness

• Add merge_group trigger to ci.yml and security.yml

Operational reliability

• Add workflow_dispatch to auto-approve, dependabot-auto-merge, post-merge, and pr-title workflows
• Add concurrency groups to auto-approve and post-merge workflows
• Add links.yml to its own path filters (workflow changes now trigger link checks)

DRY improvements

• Create .github/actions/setup-node composite action (Node.js setup + npm ci)
• Deduplicate 5 identical setup sequences across ci.yml and security.yml

Checklist compliance

Item	Before	After
Concurrency groups	8/11	10/11
workflow_dispatch	7/11	11/11
harden-runner	0/17	17/17
merge_group on CI/security	0/2	2/2
CodeQL in required checks	No	Yes
Composite actions	None	setup-node
Workflow in own path filters	Missing	Fixed
Permissions at job level	Partial	Complete
Reliable PR author check	0/3	3/3

Signed-off-by: Sebastien Tardif seb@tardif.ca