ci: add CI workflow, dependabot, and ESLint contributor rules

[florintimbuc]

Summary

• Add CI workflow (.github/workflows/ci.yml) — type check, lint, format, build, security audit
• Add Dependabot config (.github/dependabot.yml) for automated dependency updates
• Replace scripts/check-contributors-rules.mjs with ESLint custom rules (eslint-rules/pixel-agents-rules.mjs)
• Disable false-positive react-hooks rules for imperative game-state pattern

Closes #112

Design

• Foundational steps (checkout, node setup, installs) fail fast
• Validation steps (type check, lint, format, build) use continue-on-error: true with dependency guards — all run even if one fails
• Audit steps are advisory only — reported in step summary but don't block PRs
• Step summary table shows PASS/FAIL for every check
• Contributors policy checks (centralized colors, pixel-font, pixel-shadow) now run as ESLint warn rules within existing lint steps — no separate CI step needed
• react-hooks/immutability, react-hooks/refs, react-hooks/set-state-in-effect disabled (false positives on imperative OfficeState/EditorState pattern)

Attribution

This PR builds on CI work from community contributors:

• @NNTin ([#58](ci: enforce code quality #58)): CI workflow architecture, step summary design, and contributors policy concept — co-author of this PR. The policy script was replaced with equivalent ESLint rules.
• @ShemYu ([#112](ci: add GitHub Actions workflow for build, lint, and audit #112)): Independent CI proposal with similar audit steps — acknowledged as prior art

Impact on open PRs

• ci: enforce code quality #58 (NNTin): Phase 1 (CI) extracted here. PR can be rebased to only contain Phase 2 (React lint fixes).
• ci: add GitHub Actions workflow for build, lint, and audit #112 (ShemYu): Superseded by this PR's more comprehensive CI design.

Test plan

• CI runs on this PR itself (self-testing)
• Step summary table renders correctly
• ESLint rules fire as warnings (not errors) for existing violations
• Audit steps report but don't block