CI and release gate: deploy the docs, pin the toolchain, lint #17

The DocC site has never deployed, and the toolchain floats under green commits.

• Docs deploy (maintainer click): the Docs runs for 0.8.1 and 0.9.0 failed at deploy with "Tag not allowed to deploy to github-pages due to environment protection rules". In Settings > Pages set the source to GitHub Actions, and in Settings > Environments > github-pages add a tag rule *.*.*. Then re-run the Docs workflow for the newest tag.
• Pinned toolchain: ci.yml:23 and docs.yml:28 run macos-latest with "the newest Xcode", so a runner image update can change the compiler. Select a named Xcode and bump it on purpose.
• Actions: actions/checkout@v4 and friends are on deprecated Node 20 majors. Bump them and add .github/dependabot.yml for github-actions (weekly).
• Consumer checks: tools/consumer-check and tools/readme-consumer never run in CI; tools/readme-consumer fails today. Run both on every push.
• iOS: Package.swift declares iOS 18 but no job builds for iOS. Add a generic/platform=iOS build or drop the platform.
• Lint: add a SwiftFormat + SwiftLint step from one shared config, and a step that fails when public text cites files that are not in the repo.
• The tag = CHANGELOG top version check (ci.yml:36-45) exists; keep its regex in step with the CHANGELOG format change.

Done when: the newest tag's docs are live on GitHub Pages, CI runs on a named Xcode with the consumer checks, an iOS build and the lint step, and Dependabot opens action bumps.

From the 27 Oct 2026 repo audit.