chore(ci): data/release gates, CodeQL, dependency review, dev container

[tempus2016]

Adds the CI/tooling items agreed in this session — everything except the repo-wide ruff format sweep, which follows in its own PR so the reformat noise stays isolated.

Repo-specific gates

Gate	What it catches
Translation parity (scripts/check_translations.py)	A locale drifting from en.json in either catalogue (386 backend keys, 1739 card/panel keys). Currently all 14 locale files pass key-for-key.
Data files (scripts/check_data_files.py)	A blueprint, custom sentence, locale or metadata file that does not parse — the class of breakage that surfaces on a user install, not in pytest. Also cross-checks manifest.json required fields and the hacs.json zip_release/filename pairing.
Release guard (scripts/check_release.py + release-guard.yml)	A release whose manifest.json version does not equal the tag exactly (including -beta.N), and a release missing taskmate.zip — which makes it uninstallable via HACS. Polls for the asset so it does not race release-zip.yml.

Security and supply chain

• CodeQL — Python + JavaScript, security-and-quality queries, on push/PR and weekly. Findings land in the Security tab; not a merge gate.
• Dependency review — fails a PR that introduces a dependency with a known moderate+ vulnerability.
• Workflow lint — actionlint + zizmor on the CI config itself, path-filtered to .github/**.
• Findings that audit surfaced, now fixed: a template-injection in release-zip.yml (the release tag was expanded inline into a run: block; now passed via env), and persist-credentials: false on all eight checkouts.
• Dependabot — 7/14-day cooldown so a bump never lands on a hours-old release, plus a pip entry (monthly, limit 1) so a newer test-harness pin surfaces as a decision instead of never being noticed. The deliberate pin itself is untouched.

CI quality and speed

• pip + npm dependency caching — the HA test harness install was the slowest step in the run.
• pytest-cov: a per-module coverage table written into the job summary (worst-covered first) and an HTML report uploaded as an artifact. Baseline is ~20% overall.
• Removed the duplicate hassfest job from tests.yml — hassfest.yaml already runs it on every push and PR, so it was running twice per PR for no extra signal.
• ruff check now covers scripts/ as well.

Contributor experience

• .devcontainer/ — Codespaces / VS Code container that installs the toolchain and builds a scratch HA config at dev-config/ with the integration symlinked in, so hass -c dev-config runs a real HA against the working copy.
• .pre-commit-config.yaml + pre-commit.ci — ruff, the two data checks, ESLint, and whitespace hygiene.
• .github/CODEOWNERS — auto-requests review, including on fork PRs.
• .github/release.yml — groups the generated "What's Changed" list by label so dependency bumps collapse into one section. Does not replace hand-written notes.
• CONTRIBUTING.md documents all local commands; README gains Data checks / CodeQL / pre-commit.ci badges.

Diff noise, explained

README.md shows ~700 changed lines and two issue templates changed — all of it trailing-whitespace stripping, required for the whitespace hooks to pass. git diff -w on those files is empty. One missing final newline added to taskmate-child-card.js.

Needs your click (cannot be done from the API)

1. Branch ruleset — add Translation parity and Data files as required checks if you want them to gate merges (the PAT gets 403 on rulesets).
2. pre-commit.ci — install the app at https://pre-commit.ci for the badge to go live.
3. Secret scanning + push protection — Settings → Code security, free on public repos.
4. Repo settings — auto-delete head branches, require conversation resolution.

Verified locally

• actionlint — clean
• zizmor --persona regular --min-severity medium . — no findings (was 1 high + 10 medium)
• ruff check custom_components/taskmate tests scripts — clean
• python3 scripts/check_translations.py — pass, all 14 locales
• python3 scripts/check_data_files.py — pass
• pytest --cov — coverage flags and the summary renderer both work