feat(linter): add GL046-GL049 rules, AND-group support, and GL032 fix

- GL046: validate image/service pull_policy values (always, if-not-present, never)
- GL047: error when a variables.options default value is not in the options list
- GL048: error on unrecognised trigger.forward keys
- GL049: validate rules[n].allow_failure (bool or {exit_codes:} map)
- Parse and evaluate workflow.rules/job.rules nested-array AND-groups; crash
  on !!seq nodes is fixed; all members of a group must match for it to fire
- Add workflow.name and workflow.auto_cancel fields to Workflow struct
- Fix GL032 false positive: variables declared in any workflow rule's variables:
  block no longer trigger an undeclared-variable warning in sibling workflow
  rule if: expressions
- Add Windows ARM64 release build target (task build-windows-arm64)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

testdata/keywords_invalid.yml

@@ -2,6 +2,13 @@ stages:
   - build
   - test
 
+variables:
+  DEPLOY_ENV:
+    value: canary             # ERROR: not listed in options
+    options:
+      - staging
+      - production
+
 workflow:
   rules:
     - if: '$CI_PIPELINE_SOURCE == "push"'
@@ -126,3 +133,50 @@ bad-rule-when-job:
   rules:
     - if: '$CI_MERGE_REQUEST_ID'
       when: sometimes         # ERROR: invalid rules[0].when
+
+bad-pull-policy-job:
+  stage: build
+  script:
+    - echo hello
+  image:
+    name: alpine
+    pull_policy: on-demand    # ERROR: invalid pull_policy value
+
+bad-pull-policy-service-job:
+  stage: build
+  script:
+    - echo hello
+  services:
+    - name: postgres:15
+      pull_policy: lazy       # ERROR: invalid service pull_policy value
+
+bad-trigger-forward-job:
+  trigger:
+    project: mygroup/myproject
+    forward:
+      all_variables: true     # ERROR: unrecognised trigger.forward key
+
+bad-trigger-forward-key2-job:
+  trigger:
+    include:
+      - artifact: child.yml
+        job: build
+    forward:
+      inherit: false          # ERROR: unrecognised trigger.forward key
+
+bad-rules-allow-failure-job:
+  stage: build
+  script:
+    - echo hello
+  rules:
+    - if: $CI_COMMIT_BRANCH
+      allow_failure: maybe    # ERROR: invalid rules[0].allow_failure value
+
+bad-rules-allow-failure-map-job:
+  stage: build
+  script:
+    - echo hello
+  rules:
+    - if: $CI_COMMIT_BRANCH
+      allow_failure:
+        codes: [1]            # ERROR: map missing exit_codes key