Restore CI and release workflows

[yvette-carlisle]

Summary

• restore GitHub Actions for language checks, Pages deployment, and tagged releases
• restore Dependabot for Cargo, GitHub Actions, and the site npm workspace
• remove the checked-in CodeQL workflow and remove workflow path filtering
• adapt release packaging to the current Decodex.app bundle identity
• keep Radar and release-curation automations in Codex App rather than GitHub Actions

Validation

• cargo make check
• actionlint
• Ruby YAML parse for all checked-in workflows
• scripts/macos/test_decodex_app_stage.sh
• openwiki code --update --print (reviewed; unrelated generated automation was discarded)
• git diff --check

[acgxv]

Closing this implementation because it targets the pre-vNext package graph and release surface, including the old Swift App staging path and obsolete space.decodex.app bundle identity. The underlying CI, signing, notarization, dependency-update, Pages, and release requirements remain owned by the vNext package/dogfood/release reconciliation phase (XY-1303) and must be rebuilt against the frozen GPUI plus menubar architecture. No code from this branch should be merged as-is. The associated remote branch, local branch, and clean repo-local worktree are being removed.