feat(ci): consolidate 6 workflow files into 3 optimized workflows

BREAKING CHANGE: Workflow files consolidated with proper dependencies

- Create new unified CI pipeline (.github/workflows/ci.yml)
  - Multi-stage pipeline: test/lint/mypy → build → deploy
  - Add concurrency groups to cancel redundant PR runs
  - Fix bug: only push Docker images on push events (not PRs)
  - Fix bug: upgrade checkout action from v3 to v4
  - Fix bug: enforce quality gates with job dependencies
  - Preserve Redis/RabbitMQ services for tests
  - Preserve Codecov integration and test artifacts
  - Push to both Docker Hub and GHCR with proper tags
  - Include SBOM and provenance attestations

- Update release.yml: remove no-op "Trigger Docker Build" step
- Update codeql.yml: remove template comments and boilerplate

- Delete 4 redundant workflow files:
  - tests.yaml (merged into ci.yml)
  - docker-build.yaml (merged into ci.yml)
  - docker-ci.yml (merged into ci.yml)
  - deploy.yaml (merged into ci.yml)

Docker registries: Docker Hub + GHCR (Quay.io auto-builds separately)

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

.github/workflows/release.yml

@@ -60,14 +60,3 @@ jobs:
             git commit -m "chore(release): update build metadata files [skip ci]"
             git push
           fi
-
-      - name: Trigger Docker Build on Tag
-        if: startsWith(github.ref, 'refs/tags/')
-        uses: actions/github-script@v7
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const ref = context.ref;
-            const tag = ref.replace('refs/tags/', '');
-            console.log(`New tag created: ${tag}`);
-            console.log('Docker build will be triggered automatically by the docker-build workflow');