Test the platforms the shell ships binaries for, and add the rest

[DenisDrobyshev]

What this changes

glia had one job doing five things on Linux only, and actions two majors
behind. The shell ships Windows and macOS binaries from release-app.yml, and
nothing tested the library underneath them on either platform.

• lint split out from test, so a ruff failure is not reported as a test
  failure across three Python versions at once
• platforms: the suite on Windows and macOS, 3.12
• build: installs the wheel into a clean venv, imports glia and runs
  glia-shell --help. The distribution is glia-agents and the import package
  is glia — that mismatch is the packaging mistake nobody catches locally
• aggregate CI job, so branch protection has one check to require
• codeql.yml, dependabot-auto-merge.yml, .pre-commit-config.yaml
• permissions: contents: read at workflow level
• all actions to current majors, across ci.yml, docs.yml, publish.yml and
  release-app.yml

No dependabot.yml here. #1 has been open since 3 August with that file,
alongside the link corrections. This branch defers to it; the auto-merge
workflow reads its rules.

The coverage gate (--cov-fail-under=90) and the examples loop still run once,
on Linux. Measuring them three times says nothing new.

Why

Six of seven repositories were missing some part of this. This is the pass that
makes them the same.

What breaks if this is wrong

The Windows and macOS jobs are the new claim here. The suite is offline and
the core has no required dependencies, so it should pass — and on the first run
it did, which is the only evidence that counts.

glia-shell --help in the build job. It resolves through argparse and
exits 0. If a future change makes main() open a window before parsing
arguments, this step hangs rather than fails, and that is the failure mode to
watch for.

Auto-merge covers action bumps and patch bumps only; minor and major keep a
human. It does nothing until #1 lands and branch protection is on.

Checklist

• Every YAML file parses and declares a trigger
• ruff check . passes locally
• CI green, including the first ever runs on Windows and macOS
• Overlap with Point every link at the organisation, and add Dependabot #1 removed rather than duplicated

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.