CI and release gate: deploy the docs, pin the toolchain, lint #15

• Docs deploy (maintainer click): docs.yml came after the 0.10.0 tag and has never deployed. In Settings > Pages set the source to GitHub Actions, and in Settings > Environments > github-pages add a tag rule *.*.*. Then re-run the Docs workflow for the newest tag.
• Pinned toolchain: ci.yml and docs.yml pick "the newest Xcode" on macos-latest; the header already records one crash from an image update (Xcode 26.6). Select a named Xcode and bump it on purpose.
• Actions: pinned by major only (checkout@v4, upload-pages-artifact@v3, deploy-pages@v4) and no .github/dependabot.yml. Add Dependabot for github-actions (weekly).
• iOS: Package.swift declares .iOS("18.0") but no job builds for iOS. Add xcodebuild -scheme DiffractoKit-Package -destination 'generic/platform=iOS' build, or drop the platform.
• Lint: add a SwiftFormat + SwiftLint step from one shared config, and a step that fails when public text cites files that are not in the repo.
• docs.yml:5 says the kit takes no package dependencies (it depends on ImagoKit) and cites a private file; fix the comment.
• Lockfile: the root Package.resolved is tracked and pins ImagoKit 0.2.0 while the manifest accepts 0.2.0..<1.0.0; consumers ignore it. git rm --cached it and ignore /Package.resolved (or say in ci.yml that CI tests the lower bound on purpose and add an upper-bound leg).
• The tag = CHANGELOG top version check (ci.yml:51-60) exists; keep its regex in step with the CHANGELOG format change.

Done when: the newest tag's docs are live on GitHub Pages, CI runs on a named Xcode with an iOS build and the lint step, and Dependabot opens action bumps.

From the 27 Oct 2026 repo audit.