Harden and speed up the GitHub Actions workflows - #22

Summary

• Gradle configuration cache: every setup-gradle step (and dependency-submission) gets cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}, so the enhanced cache provider can save and restore the configuration cache. The reusable build-and-verify.yml declares the secret and ci.yml/release.yml pass it by name (not secrets: inherit). The release's publish job now uses the enhanced provider too.
• Required status check: a new All checks passed job in ci.yml needs every other job, always runs, and fails unless all of them succeeded, so branch protection can require this one check.
• Workflow linting: a new Lint workflows job runs actionlint (with shellcheck) and zizmor. .github/actionlint.yaml declares the ubuntu-26.04 runner labels. .github/zizmor.yml requires SHA pins for every action except GitHub's own actions/*.
• Concurrency: only pull request builds are cancelled by a newer push. Builds of main always finish, because only they save the caches.
• Least privilege: release.yml is read-only by default, and only github-release and update-readme get contents: write. pull-requests: write in ci.yml moves to the job that needs it. Checkouts set persist-credentials: false except where the job pushes.
• Fixes from the linters: the README push reads the default branch from an environment variable instead of expanding it into the script (template injection), and the DuckDB step no longer triggers shellcheck SC2155.
• Release jobs: every job now has a timeout. The four native bundle downloads are one pattern download plus a step that moves each bundle into place and fails if one is missing.
• Dependabot: weekly grouped updates for GitHub Actions, the Gradle version catalog and wrapper, and the native collector's crates, with separate security-update groups and a cooldown before new releases are proposed. Pull requests carry the maintenance label. dtolnay/rust-toolchain is excluded because its pin must match the cargo +<version> formatting check.

Before merging

• Create the GRADLE_ENCRYPTION_KEY repository secret, for example with openssl rand -base64 16 | gh secret set GRADLE_ENCRYPTION_KEY. Without it, the configuration cache is not saved.
• If branch protection later requires All checks passed, the release's update-readme job can no longer push to main directly. It will need a bypass for GitHub Actions, or it will have to open a pull request instead.

Verification

• actionlint 1.7.12 and zizmor 1.30.1 (with online audits) pass locally with no findings.