ci: auto bump patch version on PR-merge to develop

[flupkede]

What

Adds .github/workflows/bump-develop.yml: when a PR is closed+merged into develop, automatically bumps the patch component (Major.Minor.Incr → Incr += 1) in Cargo.toml and the matching codesearch package entry in Cargo.lock, then pushes the commit as github-actions[bot].

Versioning scheme implemented

Event	Bump
commit / push / PR create	nothing
PR merge → develop	Incr (patch) +1 (auto, this workflow)
Release	Minor +1, Incr → 0 (manual: scripts/bump-version.sh --type minor, on the release branch before the tag)
Breaking change	Major (manual)

Release flow unchanged: minor-bump → PR develop→master → tag master → release.yml builds from the tag.

Why a PAT (CI_PAT), not GITHUB_TOKEN

The "block develop" ruleset (pull_request review required) blocks the default GITHUB_TOKEN (separate bot identity, no bypass role). A fine-grained PAT owned by the bypass-eligible repo owner authenticates as the owner, so it inherits the bypass and can push the bump commit.

Setup (repo owner, do NOT paste tokens into chat/PRs):

1. Create a fine-grained PAT: resource owner flupkede, repository access = All repositories (or this repo), permission Contents: Read and write.
2. Add it as an Actions secret named CI_PAT (Settings → Secrets → Actions).

concurrency serializes the bump job, so N rapid merges produce N sequential bumps (never a lost update).

Also fixes .gitignore

The blanket .*\/ rule was silently ignoring .github/ (only .githooks/ was exempted), so any new file under .github/ (e.g. this workflow) could not be git add-ed. Adds the matching !.github/ exception — same pattern as the existing .githooks/ exemption. This was a latent footgun for all future workflow/config additions.

Validation

• QC gate (mirrors CI) passed: cargo fmt --check, cargo check, cargo clippy, cargo test --lib (609 passed; 0 failed).
• Sed logic proven on temp copies of real Cargo.toml + Cargo.lock: 1.1.31 → 1.1.32 on exactly the codesearch version line (Cargo.toml L3 + Cargo.lock L632); 0 of the other 618 version lines touched; verify-greps pass.
• YAML valid (yaml.safe_load).

Not bundled (separate follow-ups)

• release.yml workflow_dispatch checkout has no ref: → manual dispatch builds master-tip but labels the Release with the typed version (mismatch). Likely related to missing macos binary in v1.1.31 #161.
• RELEASING.md says "Squash merge all PRs" / "Create PR → develop. Squash merge." — wrong: feature→develop uses merge commits; only develop→master release PRs are squash. AGENTS.md is correct.
• AGENTS.md stale claim "pre-commit hook auto-bumps patch per commit" — false (hook does cargo fmt only).