Add CodeRabbit config and CI hygiene

[tsouth89]

Summary

• Add .coderabbit.yaml matching the main Burnwatch app (chill profile, minimal PR noise).
• Harden CI and publish workflows with contents: read / persist-credentials: false.

Test plan

• CI smoke jobs green on this PR (smoke (3.9), smoke (3.12))
• CodeRabbit reviews if the app is installed on this repo
• After merge: enable branch protection requiring smoke checks

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: b419e760-ab50-4a6f-b7ef-daee26a487fc

📥 Commits

Reviewing files that changed from the base of the PR and between 3879075 and be0f2f6.

📒 Files selected for processing (3)

• .coderabbit.yaml
• .github/workflows/ci.yml
• .github/workflows/publish.yml

---

📝 Walkthrough

Walkthrough

Adds a .coderabbit.yaml file configuring automated review behavior, filtering, presentation, and disabled optional features. Updates CI permissions to contents: read and disables persisted checkout credentials in both CI and publishing workflows.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main changes: adding CodeRabbit config and tightening CI workflow hygiene.
Description check	✅ Passed	The description is directly related to the changeset and matches the added CodeRabbit config and workflow hardening.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}