ci: migrate from Drone to GitHub Actions (self-hosted runners)

[marcbachmann]

Replaces the Drone pipeline with GitHub Actions. .drone.yml is untouched, so both CIs run on the same commits until we cut over.

Runners: ubuntu-latest, deliberately. This repo is public, and GitHub-hosted minutes are free for public repos. Public repositories are also exactly where self-hosted runners should never be used — a pull request from a fork would execute untrusted code on our own machines.

What the workflow does

Drone pipeline step	GitHub Actions
eslint	npm run lint in the test job
install + build + test (cypress/browsers)	one test job in the same image family, pinned to a current tag (node 22 / Chrome 141)
release (semantic-release, push only)	release job, master + push only, needs: test
publish-gh-pages (tag only)	publish-docs job, tag only, needs: test

Karma needs no host setup: ChromeHeadlessNoSandbox comes from the container image.

Notes for review

• The release job authenticates with a GitHub App token rather than a personal access token, and sets persist-credentials: false so that token is the one used for the tag push. Without this the tag-triggered docs publish would never run, since tags pushed with the built-in GITHUB_TOKEN do not trigger workflows.
• concurrency: group: release serializes releases across the repo, since npm rejects concurrent publishes of the same package.
• CODEOWNERS requires review for changes under .github/, because workflow files decide what runs in CI and with which credentials.

Before merging

• Org-level variables/secrets for the release job must be in place
• Verify the test job passes here before relying on it
• At cutover: swap required status checks to the new job names, disable the repo in Drone, then delete .drone.yml