Bring the repository up to the standard of its siblings

[DenisDrobyshev]

stadion is the newest repository and inherited the least: ci.yml and publish.yml and nothing else. No dependency updates, no code scanning, no aggregate check — and until an hour ago no branch protection, so anything could be pushed straight to main.

Aggregate CI job. The matrix jobs carry their OS and Python version in their names, so each is a separate status context that changes the moment the matrix does. Requiring those in branch protection means a required check silently stops matching the day a Python version is added. The aggregate gives one stable name to require — the same pattern already in praxis, mlango, glia, decisionrl and lemma.

dependabot.yml, weekly on Monday like the rest of the organisation, so the Monday triage in .github sees this repository too. torch, numpy and scipy are ignored for the same reason as elsewhere: their lower bounds describe what a user may already have, not what CI runs.

dependabot-auto-merge.yml, copied unchanged from the version that already has both of its bugs fixed — reading the pull request author rather than github.actor, and not calling gh pr review --approve.

codeql.yml, retargeted from master to main.

After merging

Branch protection is on but requires no status check yet, because CI did not exist as a context. Add it once this lands:

gh api -X PATCH /repos/DrobyshevDev/stadion/branches/main/protection/required_status_checks -f strict=true -f 'contexts[]=CI'

All four YAML files parse; job graph verified as lint-and-test, verify-optima, reference-controls, ci.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.