ci: adopt shared reusable workflows

[msalvatti]

Migrates CI to the org-wide node-lib-ci@v1 reusable (lint/typecheck/unit test:cov:all/mutation) + visibility-gated security dependency-review (replaces the local dependency-review job). Build-output integrity + bundle-size budget and the MinIO Testcontainers e2e stay local. Mutation runs post-merge on main (source-gated, incremental). Adds a dependabot.yml (weekly). codeql/scorecard/osv/release untouched.

[Copilot]

Pull request overview

Migrates this library’s CI to the org-wide reusable node-lib-ci@v1 workflow, keeping only repo-specific build-output integrity, bundle-size budget, and MinIO Testcontainers E2E locally, and adds weekly Dependabot updates.

Changes:

• Switch .github/workflows/ci.yml to call the shared reusable CI workflow and add a visibility-gated reusable security dependency-review gate.
• Keep local jobs for build integrity + bundle-size checks and MinIO Testcontainers E2E.
• Add .github/dependabot.yml for weekly npm + GitHub Actions updates; update AGENTS docs for post-merge mutation behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
AGENTS.md	Updates mutation-testing documentation to match the new post-merge CI behavior.
.github/workflows/ci.yml	Replaces most local CI jobs with an org reusable workflow; retains local verify + e2e and adds reusable security gate.
.github/dependabot.yml	Introduces weekly Dependabot update configuration for npm and GitHub Actions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[msalvatti]

Not applied: false positive. tsup here runs with `format: ['esm','cjs']` + `dts: true`, which emits a per-format declaration for the CJS build (`index.d.cts`) alongside `index.d.ts`. Empirical proof: the **Verify build + size** job passed green on this exact commit (228b028) with the `d.cts` extension already in the integrity loop — if the file were missing the job would have exited 1. The stricter gate protects CJS consumers (`require`), so it stays.