[bendns]

Summary

Set up CI before going public.

• `ci.yml` — on push-to-main and every PR, runs `xcodebuild build` + `xcodebuild test` on `macos-15`. Concurrency group cancels superseded runs.
• `codeql.yml` — Swift SAST on push-to-main, PRs, and weekly cron. Free once the repo is public.
• `dependabot.yml` — weekly updates for GitHub Actions versions (no SPM deps in the project).

All three set `permissions: contents: read` (or minimum needed). CI uses ad-hoc signing (`CODE_SIGN_IDENTITY="-"`, `CODE_SIGNING_REQUIRED=NO`) to match local dev.

Test plan

• CI workflow runs green on this PR (33 / 33 tests)
• CodeQL workflow completes without errors
• Dependabot picks up new action versions next week

After merging

Once this is in, the recommended post-public checklist:

• Flip repo visibility to public
• Enable branch protection on `main` (requires PR review, require `CI` status check, no force push)
• Verify secret scanning + push protection auto-enabled (GitHub does this for public repos)
• Verify Dependabot alerts auto-enabled

Parts of this fix were generated with Claude Code assistance.