feat(linter): add GL046-GL049 rules, AND-group support, and GL032 fix

- GL046: validate image/service pull_policy values (always, if-not-present, never)
- GL047: error when a variables.options default value is not in the options list
- GL048: error on unrecognised trigger.forward keys
- GL049: validate rules[n].allow_failure (bool or {exit_codes:} map)
- Parse and evaluate workflow.rules/job.rules nested-array AND-groups; crash
  on !!seq nodes is fixed; all members of a group must match for it to fire
- Add workflow.name and workflow.auto_cancel fields to Workflow struct
- Fix GL032 false positive: variables declared in any workflow rule's variables:
  block no longer trigger an undeclared-variable warning in sibling workflow
  rule if: expressions
- Add Windows ARM64 release build target (task build-windows-arm64)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

testdata/keywords_valid.yml

@@ -15,12 +15,19 @@ default:
 
 variables:
   GO_VERSION: "1.26"
+  DEPLOY_ENV:
+    value: staging
+    options:
+      - staging
+      - production
+      - review
 
 build-job:
   stage: build
   image:
     name: golang:1.26
     entrypoint: [""]
+    pull_policy: if-not-present
   script:
     - go build ./...
   artifacts:
@@ -72,6 +79,24 @@ release-job:
     action: start
   when: on_success
 
+.trigger-valid:
+  trigger:
+    include:
+      - artifact: child.yml
+        job: build
+    forward:
+      pipeline_variables: true
+      yaml_variables: false
+
+.rules-allow-failure-valid:
+  script: echo ok
+  rules:
+    - if: $CI_COMMIT_BRANCH
+      allow_failure: true
+    - if: $CI_COMMIT_TAG
+      allow_failure:
+        exit_codes: [1, 2]
+
 .template:
   before_script:
     - echo "before"