ci: fan-out jobs and dispatch renovate checks

[kaybi-gh]

Summary

• build-and-test is now the gate. MAUI smoke, integration tests, CodeQL, and the Docker image start only if it succeeds.
• Two compiles stay (CI tests vs CodeQL). The second CodeQL build no longer starts when the gate is already red.
• GitHub does not start workflows from GITHUB_TOKEN events, so Renovate PRs had no checks. After each Renovate run, dispatch Build on any open renovate/* PR that still has no check runs.
• Docs no longer say pull_request_target was enough.

Test plan

• On a normal PR, confirm heavier jobs stay skipped if build-and-test fails
• On a green PR, confirm MAUI, integration, CodeQL, and publish-image run in parallel after the gate
• Merge this, then run Actions -> Renovate once (or wait for the next scheduled run)
• A renovate/* PR with no checks should get Build only (not standalone Integration Tests or CodeQL)
• A PR that already has check runs should be skipped (no duplicate dispatch)