Migrate to GitHub Actions + apply zizmor security hardening

[elyobo]

Summary

• Move async-hofs off the dead CircleCI setup onto GitHub Actions
• Apply the org-standard zizmor hardening pack (SHA-pinned actions, deny-all permissions, persist-credentials: false, mise + zizmor lint, dependabot grouped updates, root zizmor config)
• Adopt changesets + (trusted-publishing-capable) release flow

This is a public, MIT-licensed repo — the only one in the hardening sweep with that exposure profile. Two consequences:

1. Reusable workflows from raywhite/github-workflows (private) are not callable from a public repo — the default GITHUB_TOKEN doesn't grant cross-repo access from public → private. So release.yml and block-fixup.yml are inlined here rather than calling the reusable workflows that every other library uses.
2. arc-runner-set (self-hosted) is not available to this public repo — initial CI run sat queued indefinitely. All jobs run on ubuntu-latest.

Both of these are async-hofs-only concessions; the rest of the org-wide pattern is preserved.

Notes for review

• No source changes intended. The eslint stack had to come up off v4 to run on Node 24. I picked eslint@8, @babel/eslint-parser, eslint-config-airbnb-base@15. Several new airbnb rules would force source edits (arrow-parens, no-promise-executor-return, prefer-promise-reject-errors, prefer-exponentiation-operator, import/extensions, no-multiple-empty-lines) — I disabled them in .eslintrc rather than churn source. The stacked TS + style migration PR will re-enable them and migrate the codebase.
• ava pinned to ^3 (was ^3.5.0). ava v4 removed test.cb, which several tests rely on. Migrating those is also stacked-PR work.
• ava v3 transitive deps trigger npm-audit moderate warnings; accepted for this pass since the stacked PR will replace the test runner.
• Root zizmor.yml is minimal here: no self-hosted-runner ignore (none used) and no impostor-commit: disable (no private reusable callout).

Pre-flight ask before first release

@raywhite/async-hofs needs trusted publishing enabled on npmjs before release.yml first runs on main post-merge, otherwise the publish step will fail. The workflow also passes NPM_TOKEN as a fallback secret if trusted publishing isn't configured.

Recommended review order

1. mise.toml, zizmor.yml, .github/dependabot.yml — config
2. .github/workflows/*.yml — workflows (inlined release + block-fixup)
3. package.json, .eslintrc — dep + lint adjustments (note the rule disables)
4. README.md — drop CircleCI badge, update versioning section
5. package-lock.json — full regen, big diff, mechanical

Test plan

• npm install && npm test (lint + ava) passes locally on Node 24
• mise run lint-actions clean at medium+ severity
• CI test workflow green on PR
• CI zizmor workflow green on PR
• CI block-fixup workflow green on PR

🤖 Generated with Claude Code