chore: add CI and Security workflows, drop the dead and deploy-only ones [#5]

.githooks/pre-commit

@@ -0,0 +1,13 @@
+#!/bin/sh
+#
+# Pre-commit gate. Installed by `make hooks`, which sets core.hooksPath to this
+# directory — so this file is versioned, reviewable, and reaches everyone on
+# their next pull rather than only the people who remember to re-copy it.
+#
+# A thin wrapper on purpose: the checks and the staged-file logic live in the
+# Makefile's lint-staged target, so `make lint-staged` reproduces exactly what
+# blocked a commit, and there is one place to change what runs.
+#
+# To bypass in an emergency: git commit --no-verify
+
+exec make --no-print-directory lint-staged

.github/actions/trivy-cache/action.yml

@@ -0,0 +1,26 @@
+name: Cache Trivy
+description: >
+  Restores the pinned trivy binary and its vulnerability DB from the Actions
+  cache. Both scan jobs need this, so it lives here rather than being pasted
+  into each one — the trivy-action this replaced cached both for us, and
+  `make trivy-deps`/`trivy-image` alone would re-download the binary (~30MB)
+  and the DB (~100MB+) on every run.
+
+runs:
+  using: composite
+  steps:
+    # Keyed on the Makefile's own hash so a TRIVY_VERSION bump there busts the
+    # cache automatically, plus a daily date so the DB itself never goes stale
+    # for longer than a day.
+    - id: date
+      shell: bash
+      run: echo "today=$(date -u +%F)" >> "$GITHUB_OUTPUT"
+
+    - uses: actions/cache@v4
+      with:
+        path: |
+          bin/trivy
+          ~/.cache/trivy
+        key: trivy-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Makefile') }}-${{ steps.date.outputs.today }}
+        restore-keys: |
+          trivy-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Makefile') }}-