CI: Consolidate GitHub Actions workflows

[keys-i]

Problem

Eight workflow files split closely related PR, release, triage, and failure-notification behavior. PR CI also uses pull_request_target with the default checkout, so it validates the base branch instead of the proposed PR change.

Acceptance criteria

• Keep exactly six workflow files: checks.yml, claude.yml, pr.yml, dependabot-digest.yml, release.yml, and triage.yml.
• Run formatting, Clippy, and tests independently in checks.yml and publish a pass/fail emoji table to the job summary.
• Keep Windows and macOS portability checks in pr.yml while Checks owns the Ubuntu quality gate.
• Preserve beta release and stable promotion behavior in release.yml.
• Preserve issue/comment/PR triage, fork-PR triage, and default-branch workflow failure alerts in triage.yml.
• Run PR workflows on the PR merge ref with read-only permissions and cancellation of superseded runs.
• Keep the Pull Requests workflow name used by fork-PR triage and use Checks as the Dependabot digest status source.
• Add least-privilege permissions and bounded jobs where supported.
• Validate workflow syntax and run the repository checks.

Exclusions

• No release-tool migration, dependency upgrade, or change to the shared sdkman/.github reusable workflows.
• No release, deployment, or merge as part of this issue.

Risk and verification

Manual release dispatch, workflow_run filtering, and always-run summary/failure conditions are the high-risk paths. Review their event and job conditions, validate all YAML with actionlint, then run cargo fmt --all -- --check, cargo check --locked, cargo clippy --locked, and cargo test --locked.