[Bccorb]

Closes #140, closes #134. Part of fells-code/seamless-auth-api#387 (wave 0, needs no release).

CI hygiene (#140):

• concurrency with cancel-in-progress on validate.yml and conformance.yml. release.yml keeps its serialized, non-cancelling group.
• paths-ignore on the pull request triggers of validate.yml and conformance.yml, limited to repo-root docs (*.md, docs/**, LICENSE, .github/ISSUE_TEMPLATE/**) so README and AGENTS.md changes inside a template still run. Workflow files and .changeset/** still trigger CI. main has no required status checks, so a skipped workflow cannot block a merge.
• timeout-minutes on every runner job (validate planner 10, template checks 20, release 15).

Pinning (#134):

• Every third-party action in release.yml and validate.yml is pinned to a full SHA with a version comment (actions/checkout, setup-node, setup-go, changesets/action, astral-sh/setup-uv).
• dtolnay/rust-toolchain@stable is pinned to the stable branch commit, and now passes toolchain: stable explicitly because the action previously read the toolchain from the ref name.
• The conformance reusable workflow was @main; it is pinned to the seamless-cli v0.26.0 commit (identical to main today).
• New .github/dependabot.yml for github-actions (weekly, grouped), same as seamless-auth-server.

actionlint, format:check and validate pass locally.