CI upkeep: align and bump action pins, pin uv and docs toolchain, job timeouts, Dependabot, skip drafts - #378

Routine CI upkeep. Closes #377.

Action pins (all still full SHAs with a version comment): pypa/gh-action-pypi-publish v1.13.0 (comment said release/v1) to v1.14.2; actions/checkout v7.0.0 to v7.0.1 and actions/setup-python v6.3.0 to v7.0.0 in the release and docs-deploy workflows; actions/setup-java v6.0.1 to v6.1.0; actions/upload-artifact v7.0.1 to v7.0.2; actions/download-artifact v8.0.1 to v8.0.2; zgosalvez/github-actions-ensure-sha-pinned-actions v5.0.5 to v5.0.10. Black in .pre-commit-config.yaml 26.10.0 to 26.10.1.

uv and docs: the three floating astral.sh/uv/install.sh installs (two test workflows, docs deploy) now use the 0.12.0 URL with the download-then-run retry pattern of dependency-floors. deploy-python-docs.yml installs the same pinned mkdocs, mkdocs-material and plugin versions as docs-build.yml, plus mike==2.2.0 (the pins resolve together with uv pip compile).

Timeouts (about 3x the slowest of the last 10 successful runs, per job): test 45 minutes (slowest 9.7, Windows), test-examples 120 (37.7, Windows), download-jars 90 (0.8, but the from-source engine build runs there; build-engine-jars.yml uses 75), bandit and dependency-floors 15 (0.5), summaries 5, docs-build 20, docs deploy 30, publish 60. The macOS matrix is unchanged.

Drafts and concurrency: the test workflows skip bandit, dependency-floors, download-jars and the matrix on a draft pull request, ready_for_review is added to the pull_request types so leaving draft starts the run, and the summary jobs are skipped with them (not failed). Pushes to main, dispatch and the release workflow's call always run. lint-workflows.yml gets the same pull-request-only concurrency group as the test workflows; main is never cancelled.

Also: .github/dependabot.yml (github-actions, weekly, one grouped pull request, commit prefix ci, no pip), and ubuntu-latest to ubuntu-24.04. ci-setup.md and build-architecture.md are updated for the triggers, timeouts and maintenance rules. The Python version matrices, requires-python and version text are untouched (another change owns them).

Checks run locally: every workflow and the new YAML parse; every uses: matches @[0-9a-f]{40} apart from the two local reusable-workflow calls; uvx pre-commit run on the changed files passes; actionlint 1.7.12 over all seven workflows reports nothing, before and after (shellcheck is not installed locally). The test workflows and lint run on this pull request. release-python-packages.yml and deploy-python-docs.yml only run on a release tag, so the PyPI publish bump and the docs deploy change are first exercised at the next release; the SHAs they share with the other workflows are exercised here.

🤖 Generated with Claude Code