Harden maintenance CI and toolchain provenance

[moritzbrantner]

Summary

• classify server-setup as maintenance-stage infrastructure in the repository landscape
• add repository-foundation-v1 with explicit Makefile-backed fast/full capabilities
• pin checkout and setup-node to immutable action revisions
• pin the repository's existing Node 22 CI line to exact Node 22.23.2 LTS
• pin Ruff to 0.16.6 instead of installing an unbounded latest release
• record key tool versions before the existing full repository test suite
• adopt the shared Renovate policy

Validation contract

• fast: repository lint + Python tests
• full/integration: the existing make test / tests/run-tests.sh surface, including shell, service, webhook, frontend, and Python checks

Scope

Infrastructure and verification only. No host configuration, DNS, TLS, deployment, migration, service-management, rollback behavior, or Node major-version migration.

Validation status

The default-branch CI already declares pull_request, but GitHub has created no Actions run or commit status for this PR head, including after a synchronization commit. Treat this PR as unverified and do not merge until the existing hosted validation path runs successfully.

Merge criterion

The existing complete repository test suite must pass under the pinned hosted toolchain on the exact PR head.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.