Build out CI pipeline

[crisfmb]

Summary

Establish and grow the GitHub Actions CI pipeline at .github/workflows/ci.yml.
Initial scope is workflow YAML linting, Markdown linting, generic YAML linting,
and secrets scanning. Additional checks land as the codebase introduces new
file types (Python, Dockerfiles, Terraform).

This Issue stays open until every task below ships. PRs reference it with
Refs #1.

Why

main is protected by a ruleset that requires status checks to pass, but
the required-checks list is empty. The pipeline below provides the checks
that make the gate enforcing.

Tasks

Foundation

• actionlint — workflow YAML linter
• markdownlint — Markdown linter
• yamllint — generic YAML linter
• gitleaks — secrets scanner

Python tooling (when first .py lands)

• ruff — linter and formatter
• mypy — type checker
• pytest — test runner
• bandit — Python security scanner
• pip-audit — dependency CVE scan

Testing (when first .py lands)

• Unit tests (pytest)
• Integration tests (pytest + LocalStack/moto + testcontainers)
• End-to-end tests (full FastAPI app over HTTP)

Container tooling (when Dockerfile lands)

• hadolint — Dockerfile linter
• trivy — container vulnerability scanner

Infrastructure tooling (when Terraform lands)

• tflint — Terraform linter
• checkov — Terraform security scanner

Shell

• shellcheck — when first .sh script lands

Pipeline integration

• CI status check attached to the branch protection ruleset
• CI badge added to README

Per-PR criteria

Every PR against this Issue must satisfy:

• Branch named ci/<descriptive-slug>
• All workflow YAML lints clean
• All checks visible in the PR's checks panel
• Conventional Commits: ci(<scope>): ...
• PR description includes summary, what changed, how to verify
• References this Issue with Refs #1

Technical notes

• Pin third-party actions to major version. SHA-pinning lands separately with Dependabot.
• Linter config files live at the repo root.
• Design choice per PR: parallel jobs vs steps in one job.
• Job structure follows concerns (not tools): lint, unit-test,
  integration-test, e2e-test, security, build. Tools slot
  into the relevant concern's job as they're added.

Definition of done

All tasks checked, all checks green on main, status check required by
branch protection, CI badge present in README.