fix: harden project template

[bigmooon]

Summary

• include scripts in Ruff, mypy, and coverage checks with unit tests for initialization and fix-review behavior
• add an isolated init → install-dev → ci-check integration test plus a real same-hunk partial-staging pre-commit regression test
• align Python 3.12–3.13 support with CI, pin Ruff and Commitizen CLI/hook versions, and add universal development constraints
• pin the CI runner, restrict workflow permissions, add Dependabot, MIT licensing, and current SPDX metadata
• update README documentation to describe only implemented behavior and verified results

Partial staging safety

The formatter review hook is intentionally fail-only. It never changes the Git index. The integration test stages value=2, leaves value=3 unstaged on the same line, runs the real pre-commit pipeline, and verifies both versions remain intact after the expected failure.

Verification

• make ci-check
• make full-check
• make test-integration
• commit-time pre-commit and Commitizen hooks
• push-time pytest and mypy hooks

Repository settings outside this PR

GitHub Template repository mode and the main branch ruleset/required checks still need to be enabled in repository settings. README documents the recommended configuration.