Wire up additional checks: coverage floor, ruff, pip-audit, shellcheck, actionlint, brew audit, dependabot

[clintmod]

Implements the "add now" tier of the checks review (#31).

• Coverage floor: --cov-fail-under=95 in rite test (currently 99.44%)
• ruff: ruff check + ruff format --check in rite lint, new rite format task for devs; one-time format commit applied (import sorting + formatting, no logic changes — pylint and all 82 tests unaffected). Kept pylint: ruff doesn't do cross-module inference (no-member etc.); they're complementary.
• pip-audit: new rite audit task + parallel CI audit job scanning the synced env from uv.lock (clean today)
• shellcheck on ci/scripts/*.sh and actionlint on the workflows, both in rite lint (tools pinned via mise.toml so they exist locally and in CI)
• brew style + brew audit --strict on the rendered formula inside rite build — immediately caught a real finding: the test block's "#{bin}/macprefs" string interpolation should be bin/"macprefs" (fixed here). --except=url,stable_version,github_repository because the build check installs from a local file:// tarball those checks can't evaluate.
• dependabot.yml: weekly github-actions + uv ecosystems

Everything verified locally: rite test, rite lint, rite audit, and the full rite build (formula render → style/audit → local-tap install → brew test → real backup → uninstall) all pass.

Closes #31

🤖 Generated with Claude Code