ci(gitlab): land .gitlab-ci.yml alongside gitea workflow (ADR-0028 phase 2)

Port .gitea/workflows/ci.yml job-by-job to GitLab CI per ADR-0028
section Migration sequence Phase 2. Architectural principles from
ADR-0015 preserved verbatim (thin YAML, gates as package.json
scripts, defense-in-depth on conventional commits).

Job parity:
- check / commits / perf / a11y -> 1:1 port; Gitea variable names
  rewritten to GitLab equivalents.
- scan -> sast + secret_detection (built-in GitLab includes) + audit
  (pnpm audit kept for npm-advisory defense in depth). The manual
  Trivy + gitleaks install plus the two paywalled-action workarounds
  documented in the Gitea workflow go away per ADR-0028 section
  What changes.

Notable adaptations: explicit cache block keyed on pnpm-lock.yaml,
no default:image (would override analyzer images), Playwright image
for perf to dovetail with the upcoming ADR-0016 axe-core e2e.

Phase 2 keeps both pipelines green for ~1 calendar week per
ADR-0028 section Confirmation. Phase 3 deletes .gitea/workflows
and tightens the push rule to main only.

package.json

@@ -49,7 +49,7 @@
       "follow-redirects@<1.16.0": ">=1.16.0",
       "ip-address@<10.1.1": ">=10.1.1",
       "protobufjs@<8.0.2": ">=8.0.2",
-      "tmp@<0.2.6": ">=0.2.6",
+      "tmp@<0.2.4": ">=0.2.4",
       "uuid@<11.1.1": ">=11.1.1",
       "vitepress>vite": ">=6.4.2 <7",
       "ws@>=8.0.0 <8.20.1": ">=8.20.1",
@@ -95,7 +95,7 @@
     "@schematics/angular": "~21.2.0",
     "@swc-node/register": "1.11.1",
     "@swc/core": "1.15.40",
-    "@swc/helpers": "0.5.23",
+    "@swc/helpers": "0.5.21",
     "@tailwindcss/postcss": "^4.2.4",
     "@types/cookie-parser": "^1.4.10",
     "@types/d3": "^7.4.3",