chore: tighten release plumbing for 0.3.0

[jack-arturo]

Summary

Pre-release cleanup that should land before merging the v0.3.0 release PR (#17). Closes the audit gaps surfaced by mcp-ecosystem/scripts/audit-server.sh and addresses the unresolved Copilot review on #17. After this merges, release-please will rebase #17 with the cleaned CHANGELOG.

• CHANGELOG.md — merges the hand-written 0.2.0 prose under release-please's auto-generated 0.2.0 heading and drops the stale ## [0.2.0] - Unreleased label that Copilot flagged on PR chore(main): release 0.3.0 #17 (richer history is preserved instead of deleted; already-released sections are durable across future release-please runs).
• .github/workflows/dependabot-auto-merge.yml (new) — mirrors the canonical Python template in mcp-ecosystem/templates/python/.github/workflows/dependabot-auto-merge.yml. Closes the one ❌ from audit-server.sh and lets safe Dependabot PRs (patch updates, transitive deps, GitHub Actions updates) flow through without manual review.
• .github/workflows/ci.yml — Python 3.11 + 3.12 matrix (verified locally: streamdeck, pillow>=10.0.0, and mcp[cli]>=1.6.0 all resolve binary wheels on 3.12), ruff format --check, and pytest --cov=. --cov-report=xml with codecov upload (continue-on-error: true so a missing token doesn't block CI).
• profile_manager.py / profile_server.py / tests/test_profile_manager.py — ruff format baseline. Mechanical line-collapses inside the existing 100-char limit; no behavior change. Necessary because we're adding ruff format --check to CI.

Verification

uv run ruff check .            # → All checks passed!
uv run ruff format --check .   # → 10 files already formatted
uv run pytest tests/ -q        # → 84 passed in 0.33s
uv build --out-dir dist        # builds wheel + sdist

Wheel content sanity-checked locally:

• streamdeck_assets/materialdesignicons-webfont.ttf (1.3 MB) ✓
• streamdeck_assets/mdi-meta.json (621 KB) ✓
• streamdeck_assets/skill/streamdeck-designer/SKILL.md (19 KB) + all references and recipes ✓
• Description-Content-Type: text/markdown ✓ (PyPI will render the README correctly)

Test plan

• CI passes on both python-version: 3.11 and 3.12.
• Security workflows still pass (CodeQL, pip-audit, Bandit) — none of the changes touch source files in scanning scope.
• After merge, release-please regenerates PR chore(main): release 0.3.0 #17 with the cleaned CHANGELOG. (Will follow up on that PR with a uv lock commit to sync the lockfile to 0.3.0; release-please does not currently update uv.lock.)
• Reply on the Copilot thread on chore(main): release 0.3.0 #17 referencing this PR's CHANGELOG fix and resolve.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Pre-release cleanup to tighten the v0.3.0 release process by aligning the changelog with release-please output, adding Dependabot auto-merge plumbing, and strengthening CI (Python version matrix, formatting checks, and coverage upload), plus mechanical ruff format updates.

Changes:

• Adjust CHANGELOG.md to remove the stale “0.2.0 - Unreleased” heading and keep 0.2.0 content under the release-please section.
• Add a reusable-workflow wrapper to auto-merge safe Dependabot PRs.
• Update CI to run on Python 3.11/3.12, enforce ruff format --check, and generate/upload coverage.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
CHANGELOG.md	Removes the stale unreleased heading so the 0.2.0 section matches release-please structure.
.github/workflows/dependabot-auto-merge.yml	Adds a Dependabot auto-merge workflow that delegates to an org reusable workflow.
.github/workflows/ci.yml	Adds workflow dispatch, Python matrix, formatting check, and coverage generation/upload.
profile_manager.py	ruff format-only line collapsing (no functional changes).
profile_server.py	ruff format-only line collapsing and string literal formatting.
tests/test_profile_manager.py	ruff format-only line collapsing in tests.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.