[sub-issue #53] Pre-commit + CI Pipeline

[emapuljak]

Sub-issue - Enforcement (pre-commit + CI pipeline)

Description

Turn the tooling configured in PR A into enforced gates: wire Ruff/mypy/bandit into pre-commit
for local checks, and add the GitHub Actions CI pipeline (plus a lightweight pre-merge workflow) that
blocks merges on failing checks. This is the second of three PRs (A → B → C) and depends on PR A
being merged first (it consumes the pyproject.toml tool config and the seeded CHANGELOG.md).

Scope = sub-issues 2 (pre-commit migration) and 3 (CI pipeline + pre-merge).

Out of scope (PR C): the autodoc / docstring-backfill / MyST overhaul, the docs-build CI job, and
enabling the Ruff D rule.

⚠️ The Ruff D (docstring) rule stays excluded here too — it is only switched on in PR C once
docstrings are backfilled. CI and pre-commit run Ruff without it.

The changelog gate is safe in this PR because CHANGELOG.md already exists from PR A.

---

Tasks

1. Pre-commit migration (.pre-commit-config.yaml)

• Remove the black, isort, flake8 and pyupgrade hooks.
• Add astral-sh/ruff-pre-commit (ruff-check --fix, ruff-format).
• Add pre-commit/mirrors-mypy (args src tests, pass_filenames: false, additional_dependencies: [types-setuptools]).
• Add PyCQA/bandit (-c pyproject.toml -ll, files: ^src/).
• Add kynan/nbstripout (strip notebook outputs).
• Drop check-manifest (auto-discovery + package-data from PR A makes MANIFEST unnecessary).
• Keep pyproject-fmt, the pre-commit-hooks block, and the existing ci: block.

2. CI pipeline (.github/workflows/ci.yml)

• Copy ci.yml from the template, adapted to PQuantML's package/layout.
• Set triggers to push on ["main", "dev"] + pull_request (every PR regardless of target). main is included so the eventual dev → main release-promotion PR and the released commit are gated.
• Run the pytest job as a matrix: KERAS_BACKEND (tensorflow, torch) × python-version (3.10, 3.11, 3.12) — 6 combos. Each job sets the KERAS_BACKEND env var and installs the matching backend (pip install -e ".[test,tensorflow]" / ".[test,torch]"), mirroring tests/run_tests.sh.
• Include jobs: changelog, ruff (check + format, D excluded), mypy, bandit, coverage (enforces fail_under from PR A), nbmake, and the ci-ok gate.
• changelog job requires every PR to touch CHANGELOG.md (bypassable via a skip-changelog label).
• Point dev branch protection's single required status check at CI · all checks passed (ci-ok).

3. Pre-merge workflow (.github/workflows/pre-merge.yml)

• Add pre-merge.yml — the lighter subset (ruff / mypy / bandit / pytest), backend-adapted, without coverage or notebooks. Runs on pushes to feature branches (branches-ignore: [dev, main]) for fast pre-PR feedback.

---

Acceptance Criteria

• .pre-commit-config.yaml uses ruff-check/ruff-format, mypy, bandit, nbstripout; black/isort/flake8/pyupgrade/check-manifest are removed.
• pytest and KERAS_BACKEND=torch pytest both collect and run cleanly with zero import/collection errors (irrelevant modules reported as skipped, not errored); channels_last is still exercised; run_tests.sh is gone.
• pre-commit run --all-files passes on a clean tree (Ruff D rule not active).
• ci.yml and pre-merge.yml exist and trigger correctly (CI on PRs to dev + pushes to dev; pre-merge on feature-branch pushes, ignoring dev/main).
• The pytest job runs the full KERAS_BACKEND × python-version matrix and installs the matching backend extra.
• CI jobs present: changelog, ruff, mypy, bandit, coverage, nbmake, ci-ok.
• mypy src tests and bandit -c pyproject.toml -r src/ -ll run as blocking checks (with any agreed per-module mypy overrides to reach first-green).
• The coverage job enforces fail_under = 60.
• The changelog job passes on a normal PR (because CHANGELOG.md exists) and can be bypassed with the skip-changelog label.
• Branch protection requires the CI · all checks passed check.
• pre-merge.yml runs ruff/mypy/bandit/pytest only (no coverage, no notebooks).