chore(ci): strengthen Unity and native release gates

[Codewriter90x]

Summary

Strengthens the public source-only validation pipeline without publishing Unity binaries.

CI

• prepares separate Unity EditMode and PlayMode jobs with GameCI
• keeps Unity jobs fail-closed behind UNITY_CI_ENABLED=false until valid license secrets replace the placeholders
• preserves the existing macOS CoreMIDI functional build/test job
• adds manual-build CodeQL analysis for the native C++ CoreMIDI boundary on macos-15

Release evidence

• verifies the generated source snapshot checksum inside the workflow
• records repository, commit, version and attestation URL
• retains the source snapshot evidence artifact for 30 days
• documents checksum and attestation verification

Manual gate

Adds an exact Unity 6000.5.6f1 EditMode/PlayMode procedure and requires evidence for Unity-affecting pull requests, including fork contributions where secrets are unavailable.

Validation

• Core: 42/42
• MIDI capture: 39/39
• native CoreMIDI tests: passed
• public readiness contracts: passed
• Wiki contracts: passed
• website localization contracts: passed
• clean source snapshot produced and audited

No Unity player binary, commercial audio or chart content is added.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.