Workflow filenames name when they run

## Summary

Every file in `.github/workflows/` is named for its trigger or cadence, with the descriptive naming carried by jobs.

## Motivation

alunduil-chezmoi's ADR 0004, "Name workflows for when they run", supersedes the per-subject convention: a filename should answer one question, when does this run, and jobs carry the descriptive names. #148 applied the rule to the daily sweep (`stale.yml` → `daily.yml`) and deliberately left the rest alone, so the directory now mixes both conventions.

Five of seven files name a tool, a subject, or an action rather than a when:

| File | Trigger | Names |
| --- | --- | --- |
| `bounds-bump.yml` | dispatch + Thu 08:00 | the action it performs |
| `ci.yml` | push `main`, pull request | the when ✓ |
| `daily.yml` | dispatch + daily 06:47 | the when ✓ |
| `dependency-review.yml` | pull request | the tool |
| `ghc-matrix.yml` | dispatch + Fri 18:00 | the subject |
| `pre-commit.yml` | push `main`, pull request | the tool |
| `publish.yml` | release published | the action it performs |

## Scope

- Fold `dependency-review.yml` and `pre-commit.yml` into `ci.yml` as jobs — same trigger, so under the ADR they are the same when.
- Resolve the two weeklies. `ghc-matrix.yml` (Fri 18:00) and `bounds-bump.yml` (Thu 08:00) run on different days, and one `weekly.yml` cannot hold two cadences without per-job `if:` guards on the cron. Either pick a single cadence, or keep them split and record why the ADR permits it.
- Rename `publish.yml` for its trigger.
- Decide where the rule lives. This repo has no `docs/adr/`, so either reference chezmoi's ADR or stand up an ADR here.

## Acceptance criteria

- [ ] Every filename in `.github/workflows/` answers when the workflow runs.
- [ ] Descriptive naming moved to job `name:` so each check run stays identifiable.
- [ ] The two weekly cadences are resolved one way, with the reason recorded.
- [ ] No workflow loses its trigger, permissions, or concurrency behaviour in the move.

## Additional context

- The rule: `docs/adr/0004-consolidate-ci-workflow.md` in alunduil-chezmoi, superseding its 0002.
- #148 renamed the sweep and is what surfaced this.
- #131 and #134 both edit every workflow file; sequencing matters or they conflict.
- `bounds-bump.yml` may be deleted rather than moved — #121 and #127 both propose removing it, and #101 replaced it with Renovate.