Add a PR job that installs the backend deps and runs the
settings-manifest drift guard, so a change to admin_settings_manifest.py
without regenerating settingsManifest.generated.json fails CI instead of
silently leaving the docs demo Settings screen stale.
- dev-images: build/push backend, worker, frontend to ghcr.io and Docker
Hub on every push to dev (tags: dev, dev-<sha>)
- release-images: same images on v* tag push (tags: latest, <version>)
- PR checks (into main/dev): ruff lint+format, eslint+prettier, no-push
Docker build of all targets
- CodeQL (python, js/ts), dependency-review, pip-audit, npm audit, Trivy fs
- pin .github/workflows/*.yml to LF
3252a8