Redesign Github workflows

[FooBarWidget]

• Have a single test-and-build workflow for testing everything as well as building the API server. Get rid of the separate "build API server" workflow.
• Have the deploy workflow trigger based on successful completion of API server build on the main branch.
• Syntax check Ansible.
• Security audit workflows using zizmor — thanks TanStack for the tip.
• Make test-and-build workflow compatible with pull requests.
• Enforce timeouts.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[abtreece]

Solid consolidation — security posture is meaningfully better than what it replaces. A few inline notes.

[FooBarWidget]

Addressed all feedback.

[abtreece]

LGTM. Verified the three fix commits:

• 10f1ae72 — force-push skip now recovers changed files via merge-base instead of always over-building; fail-open guards on default branch and unresolvable merge-base. Nice.
• 463a1f18 — restore-keys added.
• 2a8bb460 — -f dropped from the deploy tag push.

Accepting your calls on zizmor (blocking is the right default) and the README wording. Approving.