ci(consolidate): one root ci.yml; remove 8 inert nested workflows + 2 dependabot (P5)

GitHub only runs workflows from the repo-root .github/, so the per-package workflows never fired. Consolidated to a single root ci.yml: build + test + audit across the 4 workspace packages (kernel->memories->rules->cli), paths-gated, node 20+22 matrix, concurrency, ubuntu-latest. Removed packages/{kernel,memories,rules}/.github/ (8 workflows + 2 dependabot). Honors github-actions.md (<=2 workflows, paths-gated, concurrency). Pages deploy (pages.yml) held until Phase 6 when the repo goes public.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mcp-tool-shop

packages/rules/.github/workflows/ci.yml .github/workflows/ci.ymlpackages/rules/.github/workflows/ci.yml renamed to .github/workflows/ci.yml

@@ -4,17 +4,19 @@ on:
   push:
     branches: [main]
     paths:
-      - "src/**"
+      - "packages/**"
+      - "apps/**"
       - "package.json"
       - "package-lock.json"
-      - "tsconfig.json"
+      - "tsconfig.base.json"
       - ".github/workflows/**"
   pull_request:
     paths:
-      - "src/**"
+      - "packages/**"
+      - "apps/**"
       - "package.json"
       - "package-lock.json"
-      - "tsconfig.json"
+      - "tsconfig.base.json"
       - ".github/workflows/**"
   workflow_dispatch:
 
@@ -37,13 +39,3 @@ jobs:
       - run: npm run build
       - run: npm test
       - run: npm audit --audit-level=moderate
-      - run: npm pack --dry-run
-      - name: Coverage
-        if: matrix.node-version == 22
-        run: npm run test:coverage
-      - name: Upload coverage
-        if: matrix.node-version == 22
-        uses: codecov/codecov-action@v4
-        with:
-          files: coverage/lcov.info
-          fail_ci_if_error: false