feat: cross-platform CI matrix, sandbox hardening, and operator tooling #139

Job	Run time
clang static analyzer (scan-build)	35s
cppcheck	7m 26s
codespell	52s
actionlint	31s
shellcheck + shfmt	23s
clang-tidy	51s
	10m 38s

Provide feedback