feat: cross-platform CI matrix, sandbox hardening, and operator tooling #128

Job	Run time
codespell	31s
cppcheck	2m 28s
clang-tidy	43s
clang static analyzer (scan-build)	46s
shellcheck + shfmt	18s
actionlint	31s
	5m 17s

Provide feedback