security(ci): gate untrusted pull requests with automated security analysis

[pierrick-fonquerne]

Goal

Run meaningful security checks for contributions from forks without granting trusted access, repository write access, or secrets.

This complements #137, which tracks immutable action references and release credential isolation.

Trust model

Pull-request code is untrusted. It must run only on GitHub-hosted ephemeral runners through pull_request, with a read-only token and no secrets. Privileged publication or reporting remains restricted to main, schedules, tags, or protected environments.

Acceptance criteria

• Pull-request jobs use pull_request, never pull_request_target or a privileged workflow_run checkout of PR code.
• PR jobs receive no repository, organization, registry, AI-provider, or release secret.
• Checkout disables credential persistence and every action/workflow reference is pinned to a full SHA.
• Dependency Review blocks newly introduced vulnerable runtime dependencies at the agreed severity.
• CodeQL analyzes Rust and GitHub Actions with the security-extended suite.
• Workflow analysis runs offline or with read-only public metadata and fails on high-confidence/high-severity findings.
• RustSec runs on a schedule so new advisories are detected without a repository change.
• AI review and any write/comment automation skip fork PRs rather than requesting broader trust.
• Required-check names are stable and documented for repository rulesets.
• Tests demonstrate that a fork PR cannot read a sentinel secret, write repository contents, poison a release cache, or trigger a publishing job.