ci: add release dry-run deployment

[skhaz]

Summary

• Keep Release Please and deployment in dry-run mode; the deployed runtime is always the latest stable Wippy release, verified against a committed Ed25519 public key before execution.
• Add bounded, concurrent CI for Wippy lint, SQLite/PostgreSQL tests, lock integrity, test registration, and package dry-run validation.
• Add required security checks: Actionlint, Gitleaks history scan, Zizmor SARIF upload and zero-findings gate, pinned actions/images, least-privilege tokens, and Dependabot updates.

Required repository configuration

master has no repository ruleset or branch protection, and this token has no admin permission to configure one. Before merge, an administrator must require pull requests, CODEOWNER approval, stale-review dismissal, and these checks: Wippy lint, Tests (sqlite), Tests (postgres), Package dry run, Workflow syntax, Secrets, and Actions security. Direct pushes must be blocked.

Verification

• actionlint .github/workflows/*.yml
• go test for the runtime signature verifier
• Gitleaks repository-history scan
• Package dry run, lock validation, Wippy lint
• SQLite and PostgreSQL test suites
• GitHub Actions checks passed on the PR

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.