[Epic 6] CI/CD maturity — GitHub Actions parity #7

Summary

Replicate CNA workflow set adapted to Python/uv/PyPI.

CNA mapping

.github/workflows/*.yml (15 workflows) + dependabot.yml.

Why

Same operational maturity: PR gates, security, release automation.

Sub-issues

• PR validation workflows: test / lint / typecheck #45 PR validation workflows: test / lint / typecheck
• markdownlint + shellcheck workflows #46 markdownlint + shellcheck workflows
• MegaLinter workflow #47 MegaLinter workflow
• PR review aggregate workflow #48 PR review aggregate workflow
• TODO checker workflow #49 TODO checker workflow
• Dependabot (pip + github-actions) + auto-merge policy #50 Dependabot (pip + github-actions) + auto-merge policy
• OSV / security scanning workflow #51 OSV / security scanning workflow
• Release workflow skeleton (tag → GitHub Release) #52 Release workflow skeleton (tag → GitHub Release)

Blocks / dependencies

Blocks #9 release channel jobs.

Blocked by: #3 (tooling configs)

Reference

Parity matrix (workspace): knowledge/create-python-app-parity-matrix.md
Reference repo: https://github.com/Create-Node-App/create-node-app