chore: migrate CI to shared v3 workflows

[MAHDTech]

Replace duplicated Trivy and devenv dependency-update jobs with the shared tars-cloud/actions workflows pinned to v3.0.1. Reuse the devenv setup, execution, and status composites while preserving OpenTofu checks and module publishing and the existing semantic versioning policy.

All jobs select the enterprise/bingamon-lab runner group. The nixpkgs input moves from the frozen bump-rolling branch to the supported rolling branch and the lockfile is refreshed with devenv update, the CI App signs future dependency-update commits, and a manual dry-run option validates the updater without creating a PR. Existing Trivy scanner selections and finding exit policies are preserved. Semantic version checks refresh when PR labels change, including labels added to App-created dependency PRs. Release packages and changelogs use runner-local temporary paths to avoid collisions between concurrent jobs.

Custom jobs pass the existing Cachix token to devenv so its native cache daemon can continue publishing build results.

Validation: all pre-commit hooks pass with prek run -a; devenv test passes. CI validation also covers the shared dependency updater in dry-run mode.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.