[ironystock]

Summary

Four additions worth bundling now so the YAML migration to Blacksmith.sh runners is a single pass:

1. Tests now run on all 3 platforms (was: ubuntu only). Pair flow touches `os.UserHomeDir` / `filepath.Join` — Windows-specific path bugs would have slipped past the prior config. Combined the old `test` and `build-matrix` jobs into one matrix that does vet + test + build per platform.

2. New `mod-tidy` job catches `go.mod`/`go.sum` drift. Today's cellbuf/ansi version skew (between charmbracelet/log v1 and fang v1) was exactly the failure mode this guards.

3. New `goreleaser-check` job validates `.goreleaser.yml` syntax on every PR. Cheap (~15s) insurance against shipping a tag that immediately breaks the release pipeline.

4. New `.github/dependabot.yml`: weekly bumps for `gomod` (with `charmbracelet/` + `charm.land/` grouped into one PR per week to avoid noise) + `github-actions` ecosystems. Public CLI; dep hygiene matters before strangers start installing.

What didn't change

• `lint` job (still golangci-lint v2.11.4, ubuntu-only).
• CodeQL (still repo-settings-only — not duplicated in YAML).
• Release workflow (untouched; goreleaser flow stays as-is).

Check naming (relevant for branch protection)

After this PR, the required-check candidates are:

• `Test (ubuntu-latest)`
• `Test (macos-latest)`
• `Test (windows-latest)`
• `Mod Tidy Drift`
• `GoReleaser Config`
• `Lint`

Plus `Analyze (go)` from CodeQL. Pinning all 7 as required is solo-dev-friendly: they're all fast and you'd want them green anyway before merging.

Verification

• Workflow YAML is syntactically clean (will validate on push).
• Local: `go mod tidy && git diff --exit-code go.mod go.sum` passes.
• Local: tests pass on Windows (this dev box).

Test plan

• CI green on this PR's own changes.
• All 6 jobs (3 `Test`, `Mod Tidy Drift`, `GoReleaser Config`, `Lint`) appear in the checks UI.
• After merge, dependabot opens its first PR within a week.

Sequencing note

Open simultaneously with #10 (logger + fang re-merge). They touch disjoint paths and won't conflict regardless of merge order.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith with what you need.}

• Let Codesmith autofix CI failures and bot reviews