ci: bring up GitHub Actions workflows mirroring artifex layout

Add a reusable setup-diffbio composite action and six workflows: ci
(quality + matrix unit tests + integration + e2e + perf + coverage),
build-verification (matrix package build + import smoke contract),
quality-checks (pyright + ruff statistics summary, manual trigger),
security (pip-audit + bandit weekly + per-PR), docs (mkdocs build and
gh-pages deploy under docs.avitai.bio/diffbio/), and publish (PyPI
trusted-publishing on release plus testpypi via workflow_dispatch).

Adapted from artifex for the diffbio package: matrix targets .[dev,test]
on Linux and macOS without the gpu extra, JAX_PLATFORMS=cpu is exported
so opifex's import-time backend init picks the CPU backend, and the
pytest marker filter excludes gpu/gpu_required/cuda/slow/network/scbench/
spatialbench so CI runs only the CPU-friendly subset.

Author: mahdi-shafiei

.github/actions/setup-diffbio/action.yml

@@ -0,0 +1,82 @@
+name: Setup DiffBio
+description: Set up Python and uv, install the requested editable target, and export PYTHONPATH.
+
+inputs:
+  python-version:
+    description: Python version to install.
+    required: true
+  cache-suffix:
+    description: Cache suffix for uv.
+    required: true
+  linux-editable-target:
+    description: Editable target to install on Linux runners.
+    required: true
+  macos-editable-target:
+    description: Editable target override for macOS runners.
+    required: false
+    default: ""
+  extra-packages:
+    description: Extra packages to install after the editable target.
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: Set up Python ${{ inputs.python-version }}
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ inputs.python-version }}
+
+    - name: Install uv
+      uses: astral-sh/setup-uv@v1
+      with:
+        enable-cache: true
+        cache-suffix: ${{ inputs.cache-suffix }}
+
+    - name: Create virtual environment
+      shell: bash
+      run: uv venv --python "${{ inputs.python-version }}" --python-preference only-system --no-python-downloads
+
+    - name: Install DiffBio environment
+      shell: bash
+      env:
+        UV_CONCURRENT_DOWNLOADS: "4"
+      run: |
+        set -euo pipefail
+
+        editable_target="${{ inputs.linux-editable-target }}"
+        if [[ "${{ runner.os }}" == "macOS" && -n "${{ inputs.macos-editable-target }}" ]]; then
+          editable_target="${{ inputs.macos-editable-target }}"
+        fi
+
+        for attempt in 1 2 3 4 5; do
+          if uv pip install -e "$editable_target"; then
+            break
+          fi
+
+          if [[ "$attempt" -eq 5 ]]; then
+            echo "Failed to install $editable_target after 5 attempts" >&2
+            exit 1
+          fi
+
+          delay=$((attempt * 10))
+          echo "Install attempt $attempt failed, retrying in ${delay} seconds..." >&2
+          sleep "$delay"
+        done
+
+        if [[ -n "${{ inputs.extra-packages }}" ]]; then
+          uv pip install ${{ inputs.extra-packages }}
+        fi
+
+    - name: Export repo-local environment
+      shell: bash
+      run: |
+        {
+          echo "PYTHONPATH=$PYTHONPATH:$(pwd)"
+          echo "UV_PYTHON=${{ inputs.python-version }}"
+          echo "UV_PYTHON_DOWNLOADS=never"
+          echo "UV_PYTHON_PREFERENCE=only-system"
+          echo "UV_CONCURRENT_DOWNLOADS=4"
+          echo "JAX_PLATFORMS=cpu"
+        } >> "$GITHUB_ENV"

.github/workflows/build-verification.yml

@@ -0,0 +1,71 @@
+name: DiffBio Build Verification
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  workflow_dispatch:
+
+jobs:
+  build:
+    name: Package Build Verification (${{ matrix.os }}, py${{ matrix.python-version }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-14]
+        python-version: ["3.11", "3.12"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up DiffBio
+        uses: ./.github/actions/setup-diffbio
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache-suffix: build-${{ matrix.os }}-${{ matrix.python-version }}
+          linux-editable-target: ".[dev]"
+          macos-editable-target: ".[dev]"
+          extra-packages: types-requests types-setuptools
+
+      - name: Build package
+        run: uv run python -m build
+
+      - name: Verify package metadata
+        run: uv run twine check dist/*
+
+      - name: Run install smoke contract
+        shell: bash
+        run: |
+          set -euo pipefail
+          export JAX_PLATFORMS="cpu"
+          uv venv test_venv
+          . test_venv/bin/activate
+          uv pip install dist/*.whl
+          python - <<'PY'
+          import diffbio
+
+          expected = {
+              "configs",
+              "constants",
+              "evaluation",
+              "losses",
+              "operators",
+              "pipelines",
+              "sequences",
+              "utils",
+          }
+          missing = sorted(expected - set(dir(diffbio)))
+          assert not missing, f"missing public submodules: {missing}"
+          assert hasattr(diffbio, "__version__"), "diffbio.__version__ is missing"
+          print("public surface OK:", sorted(expected))
+          print("version:", diffbio.__version__)
+          PY
+          deactivate
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: package-artifacts-${{ matrix.os }}-py${{ matrix.python-version }}
+          path: dist/