ci: redesign pipeline with security hardening and best practices

Pipeline redesign:
- Split into test, build, release, publish jobs with clear responsibilities
- test: go tests + coverage reporting
- build: nix matrix build (x86_64-linux, aarch64-darwin) with artifact upload
- release: release-please PR management
- publish: download artifacts and upload to GitHub release

Security hardening:
- Move all permissions to job level (least privilege)
- Restrict merge.yml from write-all to contents+pull-requests write
- Add concurrency control with cancel-in-progress for PRs
- Add job timeouts across all workflows

Workflow improvements:
- Replace github-script auto-merge with gh CLI (approve + merge --auto)
- Restrict auto-merge trigger to opened/reopened events only
- Add LGTM body to approval review
- Set dependabot[bot] as flake.lock PR author for auto-merge compatibility
- Add conventional commit message and PR title to flake.lock updates
- Add defaults: run: shell: bash to ci.yml and merge.yml
- Set use-flakehub: disabled and use-gha-cache: enabled on magic-nix-cache
- Use upload-artifact@v7 with archive: false and if-no-files-found: error
- Use download-artifact@v8 with skip-decompress: true and merge-multiple: true
- Add fail-fast: false to build matrix
- Group dependabot updates to reduce PR noise
- Move fetch-depth: 0 to release job only

Nix:
- Add doInstallCheck + installCheckPhase for smoke test on nix build

Coverage:
- Drop octocov push/report (Option B): remove generated badge.svg and
  report.json from repo, keep only PR comment reporting
- Remove stale coverage badge from README

Author: iamralch

.github/dependabot.yml

@@ -6,6 +6,9 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 10
+    groups:
+      all-go-deps:
+        patterns: ["*"]
     labels:
       - "dependencies"
       - "go"
@@ -19,6 +22,9 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 10
+    groups:
+      all-actions:
+        patterns: ["*"]
     labels:
       - "dependencies"
       - "github-actions"