[minelogy-dev]

Adds Linux CI for pull requests and main: GCC 14 / Clang 19 builds, complete ASan/UBSan/leak-checked tests, strict compiler warnings, GCC static analysis, workflow/script linting, redacted full-history secret scanning, install/demo/package checks, and CodeQL security-and-quality scans. Actions are pinned, permissions are restricted, and Dependabot proposes weekly Action updates. docs/CI.md documents local reproduction and the one-time merge-protection settings.

CI explicitly selects both versioned and unversioned compiler commands and verifies their major versions, with matching LLVM 19 and sanitizer runtime packages. The host keeps its C23 constexpr option-table bound. Fixes issues exposed by these checks: stale archive assertions, test lifetime/leak bugs, Clang LTO arguments, an empty dependency-file null dereference, allocation/error cleanup, and runtime-library search bounds/double-free. Regression coverage includes empty dependency files, parallel Clang linking, and shell output capture.

Validation: GitHub Actions CI and CodeQL passed for commit 8291c43 on Ubuntu 24.04, including GCC 14 / Clang 19 builds, all 13 sanitizer tests with each compiler, example execution, temporary-prefix installation, Debian packaging, GCC static analysis, Actionlint, ShellCheck and Gitleaks.

I confirm that I have read and agree to the license terms, including
all additional permissions and additional terms, as stated in
CONTRIBUTING.md.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.