Harden CI and update vulnerable gems

[andiwand]

Reopens the work from #109, which was lost.

#109 was merged into modernize/02-conan-odr-index at 08:03, five minutes after #108 had already merged that branch into main at 07:58. modernize/02-conan-odr-index was then deleted, so although #109 shows as merged, none of its content ever reached main — .github/dependabot.yml, .ruby-version, the hardened ios_main.yml and the Gemfile.lock bumps are all still missing there. A merged PR cannot be reopened, hence this one. It targets main directly.

Same content as #109, rebased onto main, plus one new commit (Pin the runner's default Xcode) described at the bottom.

---

CI only ever built the simulator slice of one configuration, so Release-only and device-only breakage surfaced at deploy time. It also rebuilt every conan package from scratch on every run.

Changes

Coverage

• New build job compiles both flavors for iphoneos in their release configurations (ODR Full/Release, ODR Lite/Release Lite). Signing needs secrets this workflow does not have, so it runs with CODE_SIGNING_ALLOWED=NO and only proves the device slice compiles and links.

Speed

• Cache ~/.conan2/p, keyed on the conan-odr-index commit plus conan/conanfile.py and the profiles. Restored before the recipe export so current recipes win over stale ones from the archive, and conan cache clean "*" runs before the save — same shape droid uses.
• ruby/setup-ruby with bundler-cache: true instead of gem install bundler && bundle install cold every run.
• The tests lane no longer calls clear_derived_data or reset_simulator. Runners start clean anyway, and locally it just threw away the incremental build of a C++-heavy project.

Currency

• macos-14 + Xcode 16.2 → macos-26.

• bundle update, clearing all four open dependabot alerts:

  gem	before	after	patched at
  addressable	2.8.7	2.9.0	2.9.0
  excon	0.112.0	1.6.0	1.5.0
  faraday	1.10.5	1.10.6	1.10.6
  jwt	2.10.1	3.2.0	2.10.3

  fastlane goes 2.227.2 → 2.237.0 as a result, which regenerates fastlane/README.md.

• Pin fastlane in the Gemfile, add .ruby-version, add the runner platforms to the lockfile.

• Add .github/dependabot.yml (bundler, github-actions, cocoapods).

Xcode pin (new since #109)

• Xcode 26.0.1 is present on macos-26 but its iOS platform bundle is not, so every storyboard compile failed with iOS 26.0 Platform Not Installed. Pinned to 26.5, the image default, which has it installed.

Verification

• bundle exec fastlane tests locally on fastlane 2.237.0: 1 test, 0 failures.
• Both device release builds run locally, exactly as the new build job invokes them: ODR Full/Release and ODR Lite/Release Lite for -sdk iphoneos → BUILD SUCCEEDED.
• Workflow and dependabot YAML parse clean.
• Rebase onto main was conflict-free and the resulting tree is identical to the pre-rebase branch tip.

Not included

SwiftLint. Adding it now would either fail on the existing code or be configured so loosely nobody reads it — it lands after the code cleanup PR later in this stack.