Harden repository quality and CLI safety

[TheStreamCode]

Summary

• make workflow-state writes atomic and validate persisted state more strictly
• reject symlinked artifacts, file-path conflicts, unsafe integers, and stale stage-gate metadata
• harden CI with immutable action SHAs, non-persisted credentials, timeouts, concurrency, and an aggregate quality gate
• add pinned Agent Skills validation dependencies, CODEOWNERS, guided issue routing, and contributor setup
• remove the obsolete writable Dependabot auto-merge workflow

Why

The repository had a strong baseline, but interrupted state writes could corrupt run-state.json, directory artifact validation could follow symlinks, numeric overflow could serialize invalid state, and branch protection relied on only one structural check. Validation dependencies and GitHub Actions references were also not fully reproducible.

Impact

The v1 workflow contract and dependency-free runtime remain unchanged. Invalid or unsafe local states now fail earlier with explicit CLI errors, and repository checks are deterministic and easier to enforce.

Validation

• npm run check
• uvx --from skills-ref==0.1.1 agentskills validate <skill-path>
• gh skill publish --dry-run
• uvx --from actionlint-py actionlint
• uvx zizmor --pedantic .
• git diff --check

Two symlink tests are skipped locally on Windows because symlink creation returns EPERM; the GitHub Actions Linux and macOS jobs exercise those paths.