Consolidate PR + default-branch validation into canonical ci.yml

[neuron7xLab]

Motivation

• Reduce duplication and ensure PR and default-branch validation are aligned by consolidating fragmented pr-gate.yml and main-validation.yml into a single canonical workflow.
• Make triggers deterministic and default-branch-aware by using job-level guards against github.event.repository.default_branch rather than hardcoding a branch name.
• Provide a minimal, maintainable CI surface that covers all detected stacks (Python, Node.js frontends, Go, Rust, Docker) and uses lockfile-aware installs and safe caching.

Description

• Added .github/workflows/ci.yml which consolidates PR, push-to-default-branch, and workflow_dispatch validation and implements job-level default-branch guards, concurrency, and least-privilege permissions.
• Removed .github/workflows/pr-gate.yml and .github/workflows/main-validation.yml and updated .github/workflows/README.md to list the canonical workflows (ci.yml and preserved security-deep.yml).
• The ci.yml jobs include: Python quality/tests/build (black, ruff, mypy, pytest+coverage, coverage guardrail, build), dependency/security gates (pip-audit + frontend npm audit), apps/web frontend checks (format, lint, tsc, jest, build), ui/dashboard checks, Go tests (go test ./...), Rust fmt/clippy/tests/build (cargo), and Docker image build smoke tests.
• The workflow reuses the repo's authoritative scripts and actions (./.github/actions/setup-tradepulse, package.json scripts, go.mod, Rust Cargo manifest) and relies on lockfiles for deterministic installs and caching where appropriate.

Testing

• Ran go test ./... locally against the repo and it completed successfully (ok reported by go test).
• Ran cargo test --manifest-path rust/tradepulse-accel/Cargo.toml locally and the Rust unit tests completed successfully (7 passed).
• Attempted to run actionlint via Docker to validate workflow YAMLs but the local environment lacked Docker, so that check could not be executed here (will run in GitHub-hosted runners or CI job where Docker is available).
• Verified repository files and committed the new workflow and README update; CI job contents are consistent with repo tooling and lockfiles and will execute the full matrix when run in GitHub Actions.

---

Codex Task