refactor(ci): migrate to centralized tankdonut/github-actions@v1

[tankdonut]

Summary

Replaces the monolithic .github/workflows/ci.yml (3-job pipeline) with four focused workflows that consume reusable actions from tankdonut/github-actions@v1, mirroring the pattern already in production for tankdonut/toolbx-containers.

Workflows

File	Action consumed	Trigger
lint-and-test.yaml	pre-commit@v1	every PR + push to main
build-and-publish-image.yaml	ghcr-login@v1 (runtime: docker)	PR (paths), push to main (paths), weekly schedule, workflow_dispatch
prune-ghcr-images.yaml	reusable prune-ghcr.yaml@v1	daily cron + workflow_dispatch
renovate-auto-approve.yaml	renovate-auto-approve@v1	Renovate PR open/ready/synchronize

build-and-publish-image.yaml preserves every opencode-specific step: validate.sh → build.sh → tag (sha, version, latest) → container-test.sh → trivy (advisory) → ghcr-login → triple-push. Publish is gated if: github.event_name != 'pull_request' so PR runs validate everything without publishing.

renovate.json

Now matches the centralized config: platformAutomerge: true, automergeStrategy: squash, three packageRules (non-major automerge, devDeps automerge, major manual). minimumReleaseAge: "7 days" preserved — matches the AGENTS.md supply-chain guardrails (npmrc min-release-age=7, uv exclude-newer=7d).

Removed

• ci.yml deleted entirely.
• ci-status aggregator job dropped (no cross-workflow needs).
• setup-node step dropped (validate.sh is pure bash; no node dependency).
• master branch trigger + tests/** path filter dropped (vestigial).

Doc updates

README badge swapped to build-and-publish-image.yaml; every ci.yml reference updated across AGENTS.md, DEVELOPMENT.md, scripts/AGENTS.md, tests/AGENTS.md (file tree, CI Integration section, File Inventory table, code-comment pointers).

Verification

• python3 yaml.safe_load parses all 4 workflows
• jq . renovate.json validates (minimumReleaseAge=7 days, platformAutomerge=true, automergeStrategy=squash, 3 packageRules)
• All 4 centralized action refs use tankdonut/github-actions@v1
• pre-commit run --files clean (trailing whitespace, EOF, mixed-line-ending, large files, merge conflicts, private key)
• actionlint reports only one info-level SC2086 on \$GITHUB_ENV (unquoted) — matches upstream toolbx + original ci.yml convention; runner-provided absolute path, no functional issue

⚠️ Manual post-merge steps (out-of-repo)

These cannot be done in-repo and are required for full functionality:

1. Create AUTO_APPROVE_PAT repo secret — classic PAT with repo scope, or fine-grained token with PR-approve permission. Without it, renovate-auto-approve.yaml fails on every Renovate PR.
2. Update branch-protection required checks on main: the old CI / CI Status aggregator no longer exists. Require Lint & Test / pre-commit + Build & Publish Image / release.
3. Enable "Allow GitHub Actions to approve pull requests" in repo settings → General → Pull Requests. Required for platformAutomerge to function.

Test plan

• CI runs green on this PR (Lint & Test + Build & Publish Image)
• After merge: gh workflow list shows the 4 new workflows
• After merge: gh workflow run prune-ghcr-images.yaml dispatches without error
• After merge: a throwaway PR confirms the pipeline still gates merges correctly