ci: add lint, test, and coverage workflows

[IceCodeNew]

Summary

• add a lint workflow for Ruff formatting and lint checks, hadolint, and misspell
• add Python 3.11–3.14 unit-test coverage on Ubuntu and macOS
• add locked pytest-cov support and upload XML coverage reports to Codecov
• pin uv to the version required by the project while keeping Ruff on its latest release
• format the existing Python sources so the new Ruff formatting gate passes

Why

The repository did not have GitHub Actions coverage for linting, its supported Python matrix, or Codecov reporting. Declaring pytest-cov in the development dependency group keeps local and CI coverage runs reproducible through uv.lock, while formatting the current source tree establishes a clean baseline for the new Ruff check.

Validation

• uv sync --frozen
• uv run pytest --cov --cov-branch --cov-report=xml — 101 passed
• ruff format --check .
• ruff check .
• actionlint
• uv lock --check
• repository commit hooks, including zizmor, gitleaks, actionlint, and YAML/TOML checks
• GitHub Actions: lint build, Codecov coverage, CodeQL, hadolint, misspell, and the Python 3.11–3.14 test matrix all pass

[codecov]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered ☂️