sam-styles pipeline modernization (SAM Angular upgrade pilot) — IAEMOD-57412

Pipeline & tooling modernization for `@gsa-sam/sam-styles` as the **pilot** for the SAM design-library Angular upgrade epic (IAEMOD-57412).

sam-styles ships **no Angular** (pure USWDS 3.3 SCSS), so it is the risk-free first tracer bullet: it proves the CI + publish pipeline that the four Angular libraries will inherit, with zero migration risk. Coordination/tracking lives on the internal research repo (`mcaas-iae/iae-angular-upgrade` issue #4).

## Goal

Bring sam-styles up to the target pipeline: consistent Node, lint in CI, test + coverage, Dependabot, and an automated tag-gated `npm publish` (currently published manually).

## Sub-tasks

- [x] 1. Normalize Node version + remove stale CI config
- [x] 2. Add stylelint to CI — quality rules only; formatting handled by #739 (do #739 first)
- [x] 3. Add test + coverage step
- [x] 4. Add Dependabot config
- [x] 5. Add tag-gated publish workflow (dry-run; live publish handed to DevSecOps)

## Notes

- **No Angular work here** — this repo is USWDS SCSS only.
- Live `npm publish` credential (`@gsa-sam` token) is owned by DevSecOps and wired in at sub-task 5.
- Epic: IAEMOD-57412.