Add a pull_request-triggered caller that invokes the org-level
callable-dependency-review workflow to scan dependency changes and
fail on high-severity advisories.
* Add CI workflow and apply ruff formatting
* Disable cdk synth — PythonFunction requires Docker arm64 builds
The PythonFunction construct bundles via Docker with --platform
linux/arm64, which fails on GitHub Actions x86 runners. tsc --noEmit
still runs and catches TypeScript errors.
