chore: adopt devkit baseline (CI, security, JSR publish hygiene)

[RickCogley]

Summary

Implements the punch list from #3. Closes #3.

Critical fix: deno.json was missing publish.include/exclude, so every JSR install of @esolia/marquis was pulling the entire repo (assets/, docs/, docs-site/, examples/) into the package. Now bundles only the public surface — mod.ts, index.ts, ui/**, tokens/**, utils/**, assets/*.ts (typed wrappers, no raw SVGs), README.md, LICENSE.

What's in this PR

CI/CD (none previously)

• ci.yml — fmt/lint/check/test/publish-dry on PR/main
• publish.yml — tag-triggered (v*) JSR publish with provenance
• security.yml — calls eSolia/devkit/.github/workflows/secrets-and-sast.yml@main directly. Same-org call, no vendoring needed (the cross-org block we hit on RickCogley/* repos doesn't apply here)
• dependabot.yml — weekly github-actions + npm (docs-site)

JSR / publish hygiene

• publish.include/exclude blocks (the critical fix)
• Renamed publish:dry task with --allow-slow-types
• Same flag in publish.yml and ci.yml — tracked as debt (see "Out of scope")
• --allow-slow-types is needed because ui/icon-button.ts has 13 symbols missing explicit types

Deno hygiene

• Override the project .gitignore entry for deno.lock so the lockfile is committed (it was project-ignored on line 3, in addition to global)
• Exclude assets/**/*.svg from deno fmt — was reformatting SVG XML on every preflight run, leaving 17 files modified
• Commit deno.lock (JSR convention)

Tests

• tests/api_surface_test.ts — 8 credential-free smoke tests covering the export surface (utility, token, UI, asset, favicon) plus basic behavior of cn(), getButtonClasses(), getBadgeClasses(). Replaces the empty tests/ dir.

Claude tooling

• .claude/rules/change-management.md (copy from devkit shared-rules)

Doc cleanup (post-Deno-Deploy migration)

• docs/CLAUDE-GUIDE.md — replaced 3 stale Deno Deploy references with Cloudflare Workers (the strategy table row for Periodic, the "Work directly with..." principle, and the "future Deno Deploy apps" mention).

Out of scope (flagged for separate decisions)

Item	Why deferred
Root CLAUDE-GUIDE.md (795 lines) duplicates docs/CLAUDE-GUIDE.md (526 lines) — different content. The root version is the older/longer file; the docs/ version reads as a deliberate re-write.	Needs your call on what to preserve. Recommend: keep docs/ as canonical (root CLAUDE.md already redirects there), then either merge missing content from root or delete root if the dropped content was intentional.
Untracked docs/marquis-design-system-strategy.md	Looks like in-progress work — left alone.
ui/icon-button.ts slow types (13 symbols)	Adding explicit types is mechanical but separate scope. --allow-slow-types carries us until then.

Test plan

• deno fmt --check passes
• deno lint passes
• deno check mod.ts passes
• deno test --allow-read — 8 passed, 0 failed
• deno publish --dry-run --allow-slow-types succeeds — bundle is the right shape (no docs, no docs-site, no raw SVGs)
• CI workflow runs green on this PR
• Security workflow runs green on this PR (first SAST/secrets/SBOM run for marquis)

InfoSec: brings continuous SAST + secret scanning + SBOM to a repo that previously had zero security automation. Tightening publish.include/exclude also reduces accidental disclosure of internal docs (kickoff designs, strategy markdown) into the public JSR package.

[RickCogley]

Update: had to vendor secrets-and-sast.yml here too. Originally I assumed the direct caller pattern (uses: eSolia/devkit/.github/workflows/secrets-and-sast.yml@main) would work for marquis since it's same-org as devkit (the same pattern works in eSolia/esolia-llm-guard).

It doesn't. Public consumer + private source is blocked, even within the same org. Marquis is public; devkit is private. GitHub blocks the call at startup (0s, no jobs created). esolia-llm-guard works because it's private+private, same org.

So the actual rule (corrected from my earlier comment on tedasuke#3) is:

• ✅ private consumer + private source + same org → direct caller works (esolia-llm-guard)
• ❌ private consumer + private source + cross-org → blocked, vendor (RickCogley/tedasuke, RickCogley/pub-cogley)
• ❌ public consumer + private source + same org → blocked, vendor ← this PR
• ❌ public consumer + private source + cross-org → blocked, vendor

The fix in latest commits (b53b860):

• Added .github/workflows/secrets-and-sast-vendored.yml (verbatim copy of devkit's at SHA c07c51c, header rewritten with vendor metadata)
• Changed .github/workflows/security.yml from a cross-org caller to a wrapper that triggers the local vendored workflow
• Added .gitignore override for the global *secret* pattern (matches the vendored filename)

Also pulled the wrapper's extra triggers back in (schedule, workflow_dispatch) — those weren't the cause of the original failure, just things I temporarily stripped while debugging.

CI + Security workflows both green now. Note: the security workflow's display name still shows as .github/workflows/security.yml because GitHub cached the failed-startup state — should re-register as "Security" after merge.