feat: cross-platform CI matrix, sandbox hardening, and operator tooling #125

Job	Run time
actionlint	30s
clang-tidy	37s
codespell	26s
cppcheck	6m 4s
shellcheck + shfmt	20s
clang static analyzer (scan-build)	42s
	8m 39s

Provide feedback