feat: CI target architecture — sharded, budgeted, path-filtered, SHA-pinned (goal 0024)

The do-it-once pipeline from the deep-research pass (ADR-0034's
Update section carries the adopted budgets):

- changes job (dorny/paths-filter, SHA-pinned, some-with-excludes):
  docs-only PRs skip the heavy tail via job-level if: — skipped jobs
  REPORT success, so a required check can never hang at Expected
  (the exact footgun that deferred path filtering in ADR-0034,
  un-deferred with the mechanical reason).
- e2e: 3-shard matrix, workers:1 per Playwright's own CI guidance —
  the fix for the 14-failure contention incident. build-go:
  fail-fast:false (both platform legs always report).
- timeout-minutes on every job (~3x measured baselines; the 6-hour
  platform default was the alternative); ≤7min target / 10min DORA
  ceiling; 3-consecutive-breach escalation + retry-quarantine policy
  recorded in the ADR.
- ci-gate aggregator (if: always(), needs everything, skipped=pass):
  the future ruleset's single required check, decoupled from
  job-name churn. dependency-review job (PR-only).
- Every third-party action across ci.yml/release.yml/seed-liveness.yml
  pinned to a verified full commit SHA (the tj-actions supply-chain
  incident is the precedent); workflow-level permissions:
  contents: read; .github/dependabot.yml (weekly, grouped
  minor+patch, capped — no PR sprawl); .github/CODEOWNERS on
  .github/; README CI badge.

Note: docs/SPEC.md here also carries goal 0025's one-line §3.7
rollback-semantics note (both waves landed together; single file,
two same-session hunks).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FYwojT8GdUbYSoggbvEFft

Author: alicoding

.github/CODEOWNERS

@@ -0,0 +1,7 @@
+# goal 0024 / ADR-0034: not review ceremony (solo repo, one owner) --
+# this exists so a workflow-file change coming from an external PR
+# (e.g. a Dependabot github-actions bump, or any future outside
+# contributor) always requires the owner's explicit sign-off before a
+# CI/CD definition itself can change, per GitHub's own CODEOWNERS
+# protection for workflow files.
+/.github/ @alicoding

.github/dependabot.yml

@@ -0,0 +1,59 @@
+version: 2
+
+# goal 0024 / ADR-0034: keeps the three dependency ecosystems Mill
+# actually has (Go module root, the frontend npm workspace, and the
+# pinned-by-SHA GitHub Actions this repo now uses throughout) current
+# without turning into PR noise for a single-maintainer repo -- weekly,
+# grouped minor/patch bumps, a capped open-PR count per ecosystem, and
+# majors left as individual PRs since those can be breaking.
+#
+# Auto-merge is deliberately NOT configured here -- it's a later,
+# ruleset-dependent follow-up (goal 0024 item 4): auto-merging a
+# Dependabot PR only makes sense once `ci-gate` is a required check a
+# green Dependabot PR can actually satisfy on its own.
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    groups:
+      go-dependencies:
+        update-types:
+          - minor
+          - patch
+    # Major version bumps stay individual PRs (no group) -- a Go major
+    # bump can be source-breaking and deserves its own review, not to be
+    # bundled with unrelated minor/patch noise.
+
+  - package-ecosystem: npm
+    directory: /frontend
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    groups:
+      npm-dependencies:
+        update-types:
+          - minor
+          - patch
+    # Same reasoning as gomod above: majors stay individual.
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    groups:
+      github-actions:
+        # Every action in this repo is now pinned to a full commit SHA
+        # (goal 0024) with a `# vX.Y.Z` trailing comment -- Dependabot's
+        # github-actions ecosystem understands that convention natively:
+        # it bumps the SHA and rewrites the version comment together, so
+        # the comments stay accurate without manual upkeep. Grouped as
+        # one bundle (not split minor/patch/major) since action bumps
+        # carry far lower blast radius than a language dependency major.
+        patterns:
+          - '*'