Replace single build.yml with split pipelines per the CI/CD guide:
- api.yml: API with postgres, prisma, Trivy scan
- web.yml: Web with Trivy scan
- orchestrator.yml: Orchestrator with Trivy scan
- coordinator.yml: Python with ruff/mypy/bandit/pip-audit/Trivy
- infra.yml: postgres + openbao builds with Trivy
Adds path filtering (only affected packages rebuild), Trivy container
scanning for all images, and scoped per-package quality gates.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Woodpecker v3 ignores .woodpecker.yml when a .woodpecker/ directory
exists, reading only files from the directory. Since develop has
.woodpecker/codex-review.yml, the main build pipeline was invisible
to Woodpecker on develop. Move it into the directory as build.yml.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds automated code quality and security review pipeline that runs on
pull requests using OpenAI Codex with structured output schemas.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
