ci: add CI, coverage, and CodeQL workflows

[himanshu231204]

Summary

Adds GitHub Actions workflows for ModelDock, aligned with the existing release.yml convention (uv + astral-sh/setup-uv@v5 + actions/checkout@v4) and the Development.md §12 CI spec.

• check.yml — One workflow with three jobs:
  • quality-and-test — Matrix (Windows/macOS/Linux × Python 3.9–3.12): ruff check → ruff format --check → mypy src (strict) → bandit -r src → pytest. Integration tests auto-skip without Ollama.
  • coverage — pytest --cov=modeldock (term-missing + XML + HTML), uploads artifacts, and uploads to Codecov (non-blocking; needs CODECOV_TOKEN secret to report).
  • codeql — github/codeql-action v3 Python analysis with the security-and-quality query suite; runs on push/PR to main and a weekly cron.
• congrats.yml — Posts a congratulatory comment on merged PRs targeting main. Detects first contributions via the GitHub API, adds a first contribution label, and skips bot authors. Uses pull_request_target with least-privilege permissions (pull-requests: write, contents: read).
• issue-claim.yml — Lets contributors claim issues via comment commands. /claim assigns the commenter and removes help wanted / good first issue; /claim force takes over an already-claimed issue; /unclaim releases the claim. Skips bot authors. Uses issue_comment + issues triggers with least-privilege permissions (issues: write, contents: read).

This replaces the previous separate ci.yml, coverage.yml, and codeql.yml files.

Notes

• Tools run directly (not via pre-commit) because .pre-commit-config.yaml is referenced in Development.md §5 but does not exist in the repo.
• All workflow files validated as valid YAML.

Test plan

• CI matrix goes green across all OS/Python combinations
• Coverage artifact uploads on PR to main
• CodeQL analysis completes and uploads SARIF
• Congrats comment posts on merge (first-contribution variant for new contributors)
• /claim, /claim force, /unclaim work on a test issue

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.