feat(linter): add GL046-GL049 rules, AND-group support, and GL032 fix

- GL046: validate image/service pull_policy values (always, if-not-present, never)
- GL047: error when a variables.options default value is not in the options list
- GL048: error on unrecognised trigger.forward keys
- GL049: validate rules[n].allow_failure (bool or {exit_codes:} map)
- Parse and evaluate workflow.rules/job.rules nested-array AND-groups; crash
  on !!seq nodes is fixed; all members of a group must match for it to fire
- Add workflow.name and workflow.auto_cancel fields to Workflow struct
- Fix GL032 false positive: variables declared in any workflow rule's variables:
  block no longer trigger an undeclared-variable warning in sibling workflow
  rule if: expressions
- Add Windows ARM64 release build target (task build-windows-arm64)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/linter/rules.go

@@ -163,4 +163,19 @@ const (
 	// CI templates fetched over HTTP are transmitted in cleartext and can be
 	// intercepted or modified in transit.
 	RuleInsecureRemoteInclude = "GL045"
+
+	// GL046: image: or services[n]: pull_policy: contains an unrecognised value.
+	// Valid values: always, if-not-present, never (or a list of those values).
+	RuleInvalidPullPolicy = "GL046"
+
+	// GL047: a variable declared with options: has a default value: that is not
+	// listed in the options list. GitLab rejects the pipeline at creation time.
+	RuleVariableValueNotInOptions = "GL047"
+
+	// GL048: trigger.forward: contains an unrecognised key. Only
+	// pipeline_variables and yaml_variables are valid.
+	RuleInvalidTriggerForward = "GL048"
+
+	// GL049: rules[n].allow_failure: is not a boolean or a map with exit_codes:.
+	RuleInvalidRulesAllowFailure = "GL049"
 )