ci: add comprehensive verification gates

[fitz2882]

Summary

• add Python 3.10-3.13 unit-test coverage
• run six framework-specific offline integration jobs
• fail dedicated framework jobs on zero tests or any skip
• add Ruff, Bandit, package build/metadata, and installed-wheel smoke gates
• pin third-party actions to maintained Node 24 release SHAs (checkout v7.0.1, setup-python v7.0.0)
• add weekly Dependabot updates for Python and GitHub Actions

Verification

• local pytest -q: 218 passed, 3 skipped with installed optional integrations
• prior quality/package proof: Ruff, Bandit, build, Twine, and installed-wheel smoke passed
• skip-boundary proof: an intentionally missing framework makes the new assertion exit nonzero
• GitHub Actions clean-checkout matrix pending for commit 3957421