CI and release gate: enable the docs, consumer coverage, xcframework zips, lint #12

• Docs deploy (maintainer click): the Docs workflow fails on every tag because Pages is not enabled. In Settings > Pages set the source to GitHub Actions, and in Settings > Environments > github-pages add a tag rule *.*.*. Then re-run the Docs workflow for the newest tag.
• One toolchain: ci.yml uses macos-15 + Xcode 26.0, docs.yml macos-latest + the newest Xcode. Pin both to the same named Xcode. Move the pages permissions from workflow to job level; refresh the stale headers.
• Dependabot for github-actions (weekly).
• Consumer check: imports neither EMPAD nor MSA although both are declared, and leaves out Formato, FormatoPeek, FormatoMIB. Cover every product.
• libhdf5 xcframework release: the zips carry 13 AppleDouble ._* entries (ditto without --norsrc --noextattr), which may trip codesign --strict, notarization or App Store validation (unverified). xcframeworkRelease is edited by hand, and CI never resolves the URL targets (FORMATO_LOCAL_XCFRAMEWORKS=1 everywhere). Rebuild the zips clean, add one CI job that resolves the binary targets by URL, and check one archived app with codesign --verify --deep --strict before App Store work.
• Lint: add a SwiftFormat + SwiftLint step from one shared config, and a step that fails when public text cites files that are not in the repo.
• The tag = CHANGELOG top version check (ci.yml:39-48) exists; keep its regex in step with the CHANGELOG format change.

Done when: the newest tag's docs are live on GitHub Pages, every product is in the consumer check, the xcframework zips have no ._* entries and CI resolves them by URL, and the lint step runs.

From the 27 Oct 2026 repo audit.