[SebastienPittet]

Why

The old python-app.yml mixed test + publish in one job, pushed images from PRs' target branch without validation, had no unit tests running, no security scanning and no SBOM. This PR splits concerns into three clean, minimal workflows and keeps every GitHub Action component on its latest major (Dependabot's existing github-actions ecosystem bumps them).

New workflows

ci.yml (PRs + master):

• lint: ruff (lint + format), mypy, plus actionlint validating the workflows themselves.
• unit-tests: pytest with coverage → Job Summary + coverage.xml artifact.
• integration-tests: local-socket tests, no internet.
• security: pip-audit --strict (CVE gate) + CycloneDX SBOM artifact.
• docker-build: build-only validation with GHA layer cache (no push on PRs).
• manifest-validation: kubeconform strict on kubernetes/.

release.yml (master / v* tags): buildx multi-arch (amd64 + arm64 for Raspberry Pi), docker/metadata-action tags (latest, branch, semver, sha), build provenance, registry login via existing secrets, SBOM artifact. Image is now pushed only from master/tags, never from PRs.

pr-size.yml: computes PR diff size, applies size/xs…xl labels, publishes a “PR size” commit status (shown in the merge box; turns warning past 2500 lines) and a summary line — first-party gh script, zero third-party supply chain.

Badges

README gets CI, Release, PR-size and Python badges.

Housekeeping

• Removed python-app.yml (superseded).
• Removed python-version: 3.x + python-version: "3.10" mismatch → single PYTHON_VERSION=3.12 env.
• All jobs permissions: contents: read (least privilege); pr-size only gets pull-requests: write + statuses: write.
• Concurrency groups cancel stale PR runs.

Depends on #1 (needs requirements-dev.txt + tests).