chore: tighten CI and enable security automation

[stevenschling13]

Summary

• replace the ad-hoc CI workflow with a stricter Node 20 pipeline that installs dependencies with pnpm, then lints, typechecks, tests, and builds
• add a scheduled CodeQL analysis workflow for JavaScript/TypeScript to surface security issues
• enable Dependabot updates for npm dependencies and GitHub Actions to keep dependencies fresh

Testing

• pnpm run lint
• pnpm run typecheck
• pnpm run test -- --run
• pnpm run build

---

https://chatgpt.com/codex/tasks/task_e_69078f839800832cbfe72834b43ae925

[Copilot]

Pull Request Overview

This PR sets up essential development infrastructure and creates the initial lockfile for the project. The main changes include:

• Initialize pnpm lockfile with all project dependencies properly resolved
• Add CodeQL security scanning workflow for automated vulnerability detection
• Enhance CI workflow with improved structure, explicit steps, and stricter dependency installation
• Add Dependabot configuration for automated dependency updates

Reviewed Changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

File	Description
pnpm-lock.yaml	Generated complete lockfile with resolved dependencies for all packages (previously empty placeholder)
.github/workflows/codeql.yml	New CodeQL security analysis workflow for JavaScript code scanning
.github/workflows/ci.yml	Improved CI workflow with better organization, frozen lockfile installation, and proper job naming
.github/dependabot.yml	New Dependabot configuration for weekly npm and GitHub Actions updates

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.