…nd cleanup

- Parallelize moon ci with --job/--job-total matrix (2 shards)
- Add moonrepo/run-report-action for PR run reports
- Add appthrust/moon-ci-retrospect for readable CI logs
- Move OSS security scans into moon tasks (run via moon ci, not separate job)
- Move attach-release-assets scripts into their project directories
- Thin fuzz workflow — delegate to parser:fuzz moon task
- Fix renovate config to use pnpm manager

Replace individual workflow setup with reusable composite actions:
- setup: checkout, toolchain, selective caching
- moon-ci: sharded CI with reporting and retrospect
- moon-run: generic task runner with affected detection
- validate-pr-title: auto-discovered conventional commit scopes
- raa-open/close/teardown: review app deployment lifecycle

Replace workflows with DRY architecture:
- pr.yml: unified PR workflow (validate-title + ci + security + codeql + teardown)
- main.yml: push-to-main (ci + security + codeql + release-please)
- publish-to-registry.yml: reusable publish workflow
- Thin per-project publish-*.yml calling the reusable workflow
- review.yml: workflow_dispatch with RAA actions
- fuzz.yml: thin dispatch delegating to parser:fuzz

Delete replaced workflows: ci.yml, pr-title.yml, release-please.yml

Actions:
- moon-setup: checkout, toolchains (rust/bun/go/python), selective caching
- raa-open: provision review environment and deploy snapshots
- raa-teardown: deactivate deployments and clean up

Workflows:
- pr.yml: CI, CodeQL, PR title, review app open/teardown
- release.yml: release-please on main push
- publish.yml: single publish workflow with moon :publish --affected
- deploy.yml: website deploy on main push (path-filtered)
- scheduled.yml: weekly semgrep, CodeQL, and fuzz

Updated the fuzz job to echo the command instead of running it directly.