ci: add GitHub Actions workflows

[Copilot]

Reintroduces the four CI/CD workflows from PR #3 onto current master (which already carries the PR #5 mypy fixes), bypassing the stale PR chain.

Workflows

• ci.yml — ruff lint, mypy type-check, pytest (Python 3.11 + 3.12 matrix) on push/PR to master; all jobs scoped to permissions: contents: read
• schema.yml — applies schema.sql to a fresh SQLite DB on schema/migration file changes
• release.yml — builds and publishes to PyPI via OIDC trusted publishing on v*.*.* tags
• dependency-review.yml — scans dependency diffs for known vulnerabilities on every PR

Source fixes (required for CI lint job to pass)

Removes ruff violations present on master that would immediately break the new ci.yml:

• cli.py: unused list_accounts in local import
• ingest.py: unused create_account, parse_gmail_labels top-level imports; bare f-string
• db/schema.py: unused is_fresh variable
• security/policy.py: unused from typing import Any

Original prompt

Create a new pull request against master in uscient/mboxer that brings over the GitHub Actions workflow changes originally introduced in PR #3 (ci: add GitHub Actions workflows), but based on the current master branch which already contains corrected type-check changes.

Context:

• The existing PR ci: add GitHub Actions workflows #3 is based on an older branch and is no longer the desired merge path.
• master currently exists and has newer fixes already merged, including corrected type-check changes.
• We want a fresh PR that reintroduces the workflow files onto current master.

Task:

1. Compare the workflow-related changes from PR ci: add GitHub Actions workflows #3 against current master.
2. Create a new branch from master.
3. Add the GitHub Actions workflows needed from PR ci: add GitHub Actions workflows #3, preserving the intended behavior as closely as possible while adapting to current master if required.
4. Open a new pull request targeting master.

Relevant prior PR:

• PR ci: add GitHub Actions workflows #3: https://github.com/uscient/mboxer/pull/3
• Title: ci: add GitHub Actions workflows

Expected workflows from the original effort:

• .github/workflows/ci.yml
• .github/workflows/schema.yml
• .github/workflows/release.yml
• .github/workflows/dependency-review.yml

Important constraints:

• Base the new work on the current master, not the old PR branch.
• Create a brand-new PR rather than modifying or reviving the old one.
• Preserve the workflow intent: CI (ruff/mypy/pytest), schema validation, PyPI release, and dependency review.
• If any workflow needs small adjustments because master has changed, make only the minimum necessary updates.
• Use a concise PR title appropriate for the recreated workflows PR.

The following is the prior conversation context from the user's chat exploration (may be truncated):

User: @uscient/mboxer/pull/4 - what am I waiting for?

Assistant: Here's what's standing between this PR and merging:

The PR is still a Draft — that's the primary blocker. Even though everything else looks good, draft PRs can't be merged until you mark them ready for review.

Everything else is actually in great shape:

• ✅ You already approved it (reviewed and approved at 19:21 UTC today)
• ✅ CI is passing — the Dependency Review check completed successfully
• ✅ Mergeable state is clean — no conflicts

What to do: Click "Ready for review" on the PR to convert it out of draft, then it can be merged.

➡️ PR #4 — fix: resolve 6 ruff lint errors blocking CI

User: now I can do @uscient/mboxer/pull/3 ?

Assistant: Not yet — PR #3 has the same situation as PR #4, plus an ordering dependency:

Blockers:

1. Still a Draft — needs to be marked "Ready for review" before it can merge
2. Mergeable state: blocked — likely due to required status checks or a pending review request (you're listed as a requested reviewer but haven't approved yet)
3. PR fix: resolve 6 ruff lint errors blocking CI #4 must merge first — PR fix: resolve 6 ruff lint errors blocking CI #4's branch (copilot/fix-ruff-errors-in-src) targets PR ci: add GitHub Actions workflows #3's branch (copilot/create-github-actions-workflows) as its base. The ruff fixes need to land on PR ci: add GitHub Actions workflows #3's branch before PR ci: add GitHub Actions workflows #3 can pass CI and merge to master

Correct order of operations:

1. ✅ Mark PR fix: resolve 6 ruff lint errors blocking CI #4 as ready for review → merge it (fixes land on PR ci: add GitHub Actions workflows #3's branch)
2. Then mark PR ci: add GitHub Actions workflows #3 as ready for review → review & approve it → merge to master

➡️ Start with PR #4 — click "Ready for review" there first.

User: master branch has corrected type check, can you create a new pull request for master that brings the github actions workflows we added in @uscient/mboxer/pull/3 ?

Assistant: Started — I’ve kicked off creation of a fresh PR from master that reapplies the GitHub Actions workflows from PR #3 onto the current branch state.

I’ll share the new PR once it’s ready.

This pull request was created from Copilot chat.