chore: adopt the standard CI shape, CodeQL and Dependabot

[StuartMeeks]

What changed

PR A of the NextIteration.Standards adoption sequence (ADOPTING.md step 1): the canonical CI shape, CodeQL, and Dependabot.

• ci.yml replaced with the canonical template — build / three-platform test matrix / ci gate / tag-gated publish (§3.0, §3.0.1, §3.1, §3.1.1). The only differences from templates/.github/workflows/ci.yml are the v* tag glob and the repo-specific header comment, both permitted by §3.0.1. This repo needs no EXCEPTIONS.md entry.
• codeql.yml (§4.4) and dependabot.yml + dependabot-auto-merge.yml (§4.6, §4.7) added, verbatim from the templates.
• §3.5–3.7 closed as a side effect: per-workflow concurrency, timeout-minutes on every job, and a NuGet restore cache.
• Microsoft.Testing.Extensions.CodeCoverage added (§2.6). The canonical test job invokes it with -- --coverage, so the reference has to land in the same PR or the job fails on an unrecognised option.
• §2.7 completed on the test project: NoWarn extended to CA1515;CA2007, and GenerateDocumentationFile=false set ahead of PR C moving the documentation default into Directory.Build.props.

dependabot.yml deliberately carries no ignore block. §4.10 scopes that list to packages with per-TFM floors, and this repo has none — Figgle, Figgle.Fonts and Spectre.Console are all pre-1.0 and runtime-independent, so they take a single common floor (§1.5) and their majors are genuinely reviewable. An ignore entry for a package this repo does not floor per TFM would assert a policy that does not exist here.

Why

Splash was the last repo other than Auth.Providers with no ci gate, no CodeQL, and no Dependabot. Auth, SelfUpdate and Settings are all at 29/29 machine-checkable clauses; this closes eight of Splash's eighteen failing checks.

Verification

Local, at this commit:

• dotnet build --configuration Release — 0 warnings, 0 errors (TreatWarningsAsErrors is on).
• dotnet test --configuration Release -- --coverage — 80 passed, 0 failed on both net8.0 and net10.0, with a .coverage file emitted per TFM.

Windows and macOS have never run this suite. Nothing in the library touches the filesystem or an OS secret store, and hex formatting already goes through InvariantCulture, so no platform-specific defect is expected — but §3.1.1 is explicit that an untested platform is an unverified one, so CI settles it rather than this description asserting it.

Consumer impact

None. No library code, public API, or shipped package content changes. The coverage collector is test-only (IsPackable=false), and the .nuspec is untouched by this PR.

Checklist

• Build is clean — no new warnings (TreatWarningsAsErrors is on)
• Tests pass on every shipped target framework
• Public API changes carry XML docs — n/a, no API change
• CHANGELOG.md updated under [Unreleased]
• Dependency floors unchanged

🤖 Generated with Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.