Unify CI pipelines across Scala repositories

[stasimus]

All Scala repositories hand-roll their own ci.yml. That means every sbt/scoverage/coverage trap has
to be rediscovered per repo, and quality gates differ silently between projects. Tracking the move to
a single shared pipeline here.

Steps

1. Add a reusable ci.yml (done, Add reusable Scala CI workflow #3) — tests, coverage → Coveralls, binary compatibility,
   scalafmt, scaladoc. Coverage build runs before other compiles and sbt/setup-sbt disk cache is
   disabled while coverage is on, because sbt 2's compile cache is not keyed on scoverage
   instrumentation and would otherwise yield a silently empty report. Gates run as explicit sbt tasks
   rather than through a per-repo check alias, which can be (and is) stubbed to show version.
2. Pilot on two repos of different shapes (done) — Adopt shared Scala CI workflow smetrics#450 (sbt 2) and
   Adopt shared Scala CI workflow cats-helper#397 (sbt 1, stubbed check).
3. Starter workflows for new repos — Add Scala starter workflows .github#7 adds workflow-templates/ so new
   repos get the shared CI and release workflows offered by default.
4. Roll out to the remaining active public Scala libraries as thin caller files.
5. Optionally enforce with a workflows ruleset rule, the same mechanism the AI Policy Check
   already uses, plus a documented exclude list.

Known gaps

• Binary-compatibility checking is vacuous wherever CI checks out shallow: sbt-dynver reports 0.0.0
  so there is no previous version to compare against. The shared workflow uses fetch-depth: 0, which
  means adopting it can surface real pre-existing incompatibilities.
• SonarQube Cloud analysis is inconsistent across the org and is being handled separately.

Rollout PRs

• Adopt shared Scala CI workflow scache#373
• Adopt shared Scala CI workflow resource-pool#70
• Adopt shared Scala CI workflow pekko-extension#126
• Adopt shared Scala CI workflow derivation#107
• Adopt shared Scala CI workflow kafka-journal#967
• Adopt shared Scala CI workflow nats-effect#26
• Adopt shared Scala CI workflow akka-http-documenteddsl#159
• Adopt shared Scala CI workflow akka-http-play-json#165
• Adopt shared Scala CI workflow akka-test#2
• Adopt shared Scala CI workflow akka-to-pekko-adapter#13
• Adopt shared Scala CI workflow cassandra-sync#244
• Adopt shared Scala CI workflow conhub#214
• Adopt shared Scala CI workflow ddata-tools#7
• Adopt shared Scala CI workflow executor-tools#5
• Adopt shared Scala CI workflow hostname#4
• Adopt shared Scala CI workflow json-partial-update#136
• Adopt shared Scala CI workflow metric-tools#4
• Adopt shared Scala CI workflow play-json-tools#57
• Adopt shared Scala CI workflow pubsub#327
• Adopt shared Scala CI workflow random#249
• Adopt shared Scala CI workflow scassandra#360
• Adopt shared Scala CI workflow sharding-strategy#288
• Adopt shared Scala CI workflow skafka#607
• Adopt shared Scala CI workflow sstream#242
• Adopt shared Scala CI workflow throttler#182
• Adopt shared Scala CI workflow akka-effect#510
• Adopt shared Scala CI workflow kafka-flow#893
• Adopt shared Scala CI workflow smetrics#450 (pilot)
• Adopt shared Scala CI workflow cats-helper#397 (pilot)
• Add Scala starter workflows .github#7 (starter workflows)
• Harden caller snippet for Sonar quality gate #6 (caller hardening)

Not included

• sequentially uses sbt-projectmatrix and so has no ++ cross-build; the shared workflow needs an input for that first.
• metered-scaffeine publishes without sbt-dynver or the Artifactory plugin.
• The Maven Central publishers, non-libraries and the stale set, per the out-of-scope note above.