Harden CI: Artifactory OIDC, RubyGems Trusted Publishing, Gemfile.lock

[MichaelGHSeg]

Summary

• Add Artifactory OIDC composite action — exchanges GitHub OIDC token for short-lived Artifactory access token, configures Bundler to resolve through `virtual-gems-thirdparty`
• Replace `ruby.yml` with `ci.yml` — fork-aware runner selection, rubocop/test/build jobs, Ruby 3.1–3.3 matrix, SHA-pinned actions
• Add `deploy.yml` — RubyGems Trusted Publishing (OIDC, no stored API key), gated behind `environment: rubygems`
• Add `Gemfile.lock` with `arm64-darwin` + `x86_64-linux` platforms
• Update `e2e-tests.yml` — remove `E2E_TESTS_TOKEN` (sdk-e2e-tests going public), SHA-pin actions, fork-aware
• Add `devbox.json`, add `.claude/` to `.gitignore`

Test plan

• CI runs on this PR
• Artifactory OIDC exchange succeeds on same-repo CI
• Before merging: register RubyGems Trusted Publisher (repo: `segmentio/analytics-ruby`, workflow: `deploy.yml`, environment: `rubygems`)
• Before merging: create `rubygems` GitHub environment with protection rules
• Before merging: set `ARTIFACTORY_URL` repository variable
• Before merging: remove `RUBYGEMS_AUTH_TOKEN` secret once OIDC confirmed working