Add GitHub CI security and release workflows

docs/roadmap.md

@@ -265,6 +265,20 @@ control, local CAS, service installation, and written architecture decisions.
   - Windows install targets a per-user scheduled task.
   - Tests verify generated definitions do not target privileged system services.
 
+- `[x]` GitHub CI, security, and release automation.
+  Acceptance criteria:
+  - `[x]` CI runs formatting, clippy, docs, check, and deterministic workspace
+    tests on Linux, macOS, and Windows.
+  - `[x]` Iroh-heavy daemon-to-daemon tests are represented by a visible
+    network integration job instead of blocking deterministic platform coverage.
+  - `[x]` RustSec advisory scanning runs on pull requests, pushes, manual
+    dispatch, and a weekly schedule.
+  - `[x]` CodeQL and dependency review workflows are present for GitHub-native
+    security scanning.
+  - `[x]` Release workflow builds Linux, macOS, and Windows archives for `v*`
+    tags and manual dispatch.
+  - `[x]` Dependabot is configured for Cargo and GitHub Actions updates.
+
 - `[x]` Bootstrap docs and ADRs.
   Acceptance criteria:
   - README explains what geth is and what it is not.