feat(linter): add GL046-GL049 rules, AND-group support, and GL032 fix

- GL046: validate image/service pull_policy values (always, if-not-present, never)
- GL047: error when a variables.options default value is not in the options list
- GL048: error on unrecognised trigger.forward keys
- GL049: validate rules[n].allow_failure (bool or {exit_codes:} map)
- Parse and evaluate workflow.rules/job.rules nested-array AND-groups; crash
  on !!seq nodes is fixed; all members of a group must match for it to fire
- Add workflow.name and workflow.auto_cancel fields to Workflow struct
- Fix GL032 false positive: variables declared in any workflow rule's variables:
  block no longer trigger an undeclared-variable warning in sibling workflow
  rule if: expressions
- Add Windows ARM64 release build target (task build-windows-arm64)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

testdata/nested_rules.yml

@@ -0,0 +1,31 @@
+---
+# Tests that workflow.rules and job.rules accept the nested-array (AND-group)
+# form where each outer entry can itself be a sequence of rule conditions.
+workflow:
+  name: "${PIPELINE_NAME}"
+  auto_cancel:
+    on_new_commit: interruptible
+  rules:
+  - if: "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
+    variables:
+      PIPELINE_NAME: "main"
+  - - if: "$CI_PIPELINE_SOURCE == 'push' && $CI_COMMIT_BRANCH =~ /^feat\\///"
+      variables:
+        PIPELINE_NAME: "feature"
+  - - if: "$CI_COMMIT_TAG"
+    - if: "$DEPLOY"
+      variables:
+        PIPELINE_NAME: "deploy"
+
+variables:
+  DEPLOY: "false"
+
+build:
+  stage: build
+  script: echo building
+  rules:
+  - if: "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
+  - - if: "$CI_PIPELINE_SOURCE == 'push'"
+      allow_failure: true
+    - if: "$DEPLOY"
+      when: manual