chore(ci): restructure pipeline with release-please and GitHub App token

[eschaar]

• merge qa.yml into commit.yml (branch-push gate)
• restructure verify.yml to cross-version test matrix (py3.11-3.14)
• add automerge.yml for Dependabot safe auto-merge policy
• replace semver-action release flow with release-please
• add publish.yml with SemVer + actor guardrails
• add GitHub App token to release.yml (triggers PR checks on release PRs)
• update dependabot.yml with groups and assignees
• add docs/design/cicd.md as canonical pipeline reference
• update workflow.md, README.md, CONTRIBUTING.md to match

[Copilot]

Pull request overview

This PR updates vstack’s CI/CD and release automation by splitting quality/test gates into dedicated workflows, introducing Release Please for versioning/release PR management, and documenting the resulting pipeline as the canonical reference.

Changes:

• Replaced the previous SemVer/tag-driven release flow with Release Please + a separate publish-on-release workflow.
• Reworked CI into clearer lanes: commit policy + lint/typecheck, fast single-version tests, full cross-version verify matrix, and Dependabot auto-merge policy.
• Added/updated canonical CI/CD documentation and aligned contributor docs/configuration to match.

Reviewed changes

Copilot reviewed 21 out of 22 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pyproject.toml	Bumps dev tool minimum versions (ruff/mypy/pre-commit) and aligns tox deps.
poetry.lock	Locks updated to reflect dependency/tooling bumps.
cchk.toml	Allows docs conventional commit type for commit policy enforcement.
.pre-commit-config.yaml	Updates ruff and markdownlint hook revisions.
.github/workflows/qa.yml	Removes legacy combined QA workflow (replaced by commit/check/verify split).
.github/workflows/commit.yml	Extends commit workflow to include lint/typecheck and run on PRs as merge gate.
.github/workflows/check.yml	Adds single-version unit test workflow for fast feedback.
.github/workflows/verify.yml	Converts verify into cross-version test matrix + artifact install/verify gate.
.github/workflows/automerge.yml	Adds Dependabot safe auto-approve/auto-merge policy via pull_request_target.
.github/workflows/release.yml	Switches release orchestration to Release Please using a GitHub App token.
.github/workflows/publish.yml	Adds publish workflow triggered by GitHub release publication with tag/actor guardrails.
.github/workflows/README.md	Documents the workflow map and points to canonical CI/CD design doc.
.github/dependabot.yml	Adds grouping + assignee defaults for pip and GitHub Actions updates.
.release-please-config.json	Configures Release Please (no v tag prefix, changelog sections, PR title pattern).
.release-please-manifest.json	Initializes manifest version for Release Please.
docs/design/cicd.md	Adds canonical CI/CD pipeline spec, sequences, and required repo settings.
docs/design/workflow.md	Links workflow doc to CI/CD canonical spec and updates workflow table/model.
README.md	Updates CI/release automation documentation to match new workflow split.
CONTRIBUTING.md	Updates contributor/maintainer guidance and adds repo settings checklist.
docs/test-report.md	Minor formatting tweaks (hard line breaks).
docs/security-report.md	Minor formatting tweaks (hard line breaks).
docs/performance-baseline.md	Minor formatting tweaks (hard line breaks).