Add the Step icon, CI, Dependabot and CODEOWNERS

Repo hygiene the six Steps need before they are published, none of which
existed yet.

- assets/icon.svg, synced into every steps/<id>/assets/ by build.sh so
  the six copies cannot drift. Built from web's logo-head.svg on an
  opaque white background at 256x256, matching the shape first-party
  icons use (xcode-test's content is full-bleed 256x252). White rather
  than TestingBot blue because the mark's visor is already that blue and
  loses its edge against it. One icon for all six, the way BrowserStack
  and LambdaTest brand theirs. Checked legible at 32px and 64px, the
  sizes the step picker and integrations page actually render.

  The icon goes to the StepLib in a SEPARATE pull request per Step, after
  that Step's own PR is merged. Without it the integrations page shows a
  placeholder next to competitors' branded entries.

- .github/workflows/ci.yml runs audit-all.sh and, as a separate matrixed
  job, `bitrise run check` per Step -- the linter StepLib CI runs on a
  submission. On macOS so the suite meets bash 3.2; ubuntu ships bash 5
  and would not catch a bashism. Everything is offline: no credentials,
  no device minutes.

- Dependabot covers the Actions in that workflow. It cannot see
  `cli_version`, which is a bare version string inside each step.yml
  rather than a package manifest, so renovate.json carries a regex
  manager for it. That pin is what keeps a published Step reproducible,
  so it has to move deliberately. Renovate is inert until the GitHub App
  is installed on the org.

- CODEOWNERS names @jochen-testingbot, read off the commit author rather
  than guessed: an entry naming a team that does not exist, or a user
  without write access, is silently ignored and assigns nobody. A team
  is the better answer once one exists. I could not check the org's
  teams -- SAML blocks the token.

Author: jochen-testingbot

.github/CODEOWNERS

@@ -0,0 +1,13 @@
+# Every Step here is mirrored to its own public repository and published to the
+# Bitrise StepLib. Verified Steps carry a maintainer SLA -- first response
+# within 5 business days -- so reviews must not sit unassigned.
+#
+# A CODEOWNERS entry naming a team that does not exist, or a user without write
+# access, is silently ignored: GitHub assigns nobody and no warning reaches the
+# pull request. Prefer a team here once one exists (@testingbot/<team>), since a
+# single username stops working the day that person is away.
+#
+# Note that user-facing issues land on the six mirrors rather than on this
+# monorepo, so each mirror wants its own copy of this file.
+
+* @jochen-testingbot

.github/dependabot.yml

@@ -0,0 +1,15 @@
+version: 2
+
+updates:
+# The Steps themselves have no package manifest -- they are bash, and the one
+# dependency they pin (`cli_version`, the @testingbot/cli release) lives inside
+# each step.yml, which Dependabot cannot parse. That pin is handled by the
+# regex manager in renovate.json instead.
+- package-ecosystem: github-actions
+  directory: /
+  schedule:
+    interval: monthly
+  commit-message:
+    prefix: "ci"
+  labels:
+  - dependencies

.github/workflows/ci.yml

@@ -0,0 +1,63 @@
+name: CI
+
+# Everything here runs offline: the Steps are exercised against tests/mock_api.py
+# and tests/stubs/, so no TestingBot credentials are needed and no device minutes
+# are spent. The live checks live in scripts/e2e.sh and are run by hand.
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    name: Audit and offline tests
+    # macOS so the suite runs against bash 3.2, the oldest shell the Steps have
+    # to work on. Ubuntu ships bash 5 and would not catch a bashism.
+    runs-on: macos-latest
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Install the Bitrise CLI
+      run: |
+        brew install bitrise
+        bitrise setup
+
+    - name: Install linters
+      run: brew install shellcheck yamllint
+
+    - name: Audit
+      # Sync check, shellcheck, yamllint against Bitrise's own config,
+      # stepman audit and bitrise validate per Step, then the offline suite.
+      run: ./scripts/audit-all.sh
+
+  check:
+    name: StepLib linter
+    runs-on: macos-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        step:
+        - testingbot-upload-app
+        - testingbot-espresso
+        - testingbot-xcuitest
+        - testingbot-maestro
+        - testingbot-tunnel
+        - testingbot-tunnel-stop
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Install the Bitrise CLI
+      run: |
+        brew install bitrise
+        bitrise setup
+
+    - name: bitrise run check
+      # The linter StepLib CI runs on a submission: yamllint, step.yml against
+      # the official JSON schema, and step.yml against the README. Slow (it
+      # clones a repo per Step), which is why it is a separate job.
+      working-directory: steps/${{ matrix.step }}
+      run: bitrise run check

README.md

@@ -35,6 +35,7 @@ it references.
 steps/<id>/           one Step: step.yml, step.sh, bitrise.yml, README.md, docs/
 lib/testingbot.bash   shared bash helpers, inlined into each step.sh
 shared/               files copied verbatim into every Step (docs/contributing.md)
+assets/icon.svg       the Step icon, synced into every steps/<id>/assets/
 scripts/build.sh      sync shared sources into each Step
 scripts/gen-readme.sh regenerate READMEs with Bitrise's steps-readme-generator
 scripts/publish.sh    mirror one Step to its own repo, tag it, print share commands
@@ -45,7 +46,7 @@ tests/                offline test suite, runs the Steps against mocks
 Generated, so never edit by hand:
 
 - the inlined library between the markers in each `step.sh` — `scripts/build.sh`
-- each Step's `LICENSE`, `.gitignore` and `docs/contributing.md` — `scripts/build.sh`
+- each Step's `LICENSE`, `.gitignore`, `docs/contributing.md` and `assets/icon.svg` — `scripts/build.sh`
 - each Step's `README.md` — `scripts/gen-readme.sh`, which runs Bitrise's own
   `steps-readme-generator` from `step.yml` + `docs/examples.md` +
   `docs/contributing.md`