Bring CI up to the standard the other repositories already meet

[DenisDrobyshev]

What this changes

praxis had the thinnest pipeline in the organisation: one job, Python 3.12 on
Linux, and actions two major versions behind. The package declares 3.11 through
3.13 and ships praxis-demo, praxis-ask and praxis-eval — nothing verified
any of that.

• test matrix across 3.11, 3.12 and 3.13, plus macOS and Windows on 3.12
• build installs the wheel into a clean venv and runs every console script
• aggregate CI job — one check name for branch protection, so adding a matrix
  entry later cannot silently leave it unguarded
• codeql.yml: weekly and on every push, security-and-quality queries
• dependabot-auto-merge.yml: action bumps and patch bumps only; minor and
  major keep a human
• .pre-commit-config.yaml, including ruff-format
• all actions moved to current majors (checkout v4 → v7, setup-python v5 → v7)

No dependabot.yml here. #1 has been open since 3 August with that file.
This branch defers to it; the auto-merge workflow reads its rules.

Why

Six of seven repositories have some part of this; only mlango has all of it.
praxis is the flagship, and it had the least.

What breaks if this is wrong

The pipeline itself, and nothing a user installs. Two decisions worth arguing
with:

ruff format --check is not in CI. Nineteen files predate the formatter, so
the gate would be red the day it lands. Reformatting belongs in its own commit.
The ruff-format hook in pre-commit covers what a contributor touches until
then. ruff check passes today and stays gated.

mypy is not in CI either. There is no mypy configuration in
pyproject.toml, and turning it on across an unannotated src/praxis would
produce a wall of errors that has nothing to do with this change.

Auto-merge only queues a merge: GitHub still waits for the required checks, and
a red build leaves the pull request open. It does nothing until #1 lands and
branch protection is on.

Checklist

• Every YAML file parses and declares a trigger
• ruff check src tests scripts clients passes locally
• CI green — the full new matrix passed on the first run
• Overlap with Publish a documentation site, an English README, and Dependabot #1 removed rather than duplicated

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.