chore: harden repository automation

[santi020k]

Summary

• consolidate title, changeset, compatibility, and documentation deployment checks behind one stable required gate
• keep one full Node 22 validation while narrowing Node 24 and Windows checks to the published CLI package
• pin every action to an immutable commit and reduce CodeQL and Dependabot schedules to monthly
• fetch deployment and publishing credentials through restricted Infisical OIDC environments
• explicitly validate release PRs created by the default GitHub token
• patch all currently reported moderate and high dependency advisories

Validation

• pnpm audit --audit-level moderate (0 vulnerabilities)
• pnpm run validate
• actionlint
• git diff --check

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2fcac946f8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve manual documentation deployments on main

When an operator manually dispatches this workflow on main, the changes job deliberately sets docs=true, but this condition still skips deploy-docs for every workflow_dispatch event. Because this commit also deletes the standalone deploy-docs.yml workflow that supported manual dispatches, there is now no way to manually redeploy the documentation after an infrastructure or credential-only change; allow dispatches from main while continuing to exclude the release-branch validation dispatch.

Useful? React with 👍 / 👎.