CI and release gate: pin Xcode, Dependabot, lint, tag check, docs deploy #17

• CI picks the newest Xcode via sort -V, which can select a beta; docs.yml runs on macos-latest. Pin one runner image and Xcode version.
• Stale comments in workflows ("no package dependencies" is false). Move Pages permissions from workflow level to the deploy job.
• Add .github/dependabot.yml for github-actions; run unit tests with --parallel.
• iOS is declared but never built: build it or drop the claim.
• CIScriptTests.swift parses ci.yml as text; move that check into the workflow or delete it.
• Add: a SwiftFormat + SwiftLint step from the shared config; a step that fails when a tag differs from the top CHANGELOG.md version; a step that fails on references to material outside the repo.
• needs-paul: GitHub Pages is off. Enable Pages (source: GitHub Actions) and add a *.*.* tag rule to the github-pages environment, then re-run the Docs workflow.

Done when: CI pins its toolchain, Dependabot is on, lint, tag and reference checks run on every push, and the DocC site is live.

From the 27 Oct 2026 repo audit.