[aien-spark]

Prepares this repository for an outside, independent security audit. Draft on purpose: nothing here changes a gate, a trust anchor or a receipt, and no label is set.

Changes

• SECURITY.md: private reporting (GitHub private advisory where enabled, else email drake@aienos.com), response targets, scope, supported versions, honest status.
• AUDIT_SCOPE.md: what to review in priority order, trust boundaries, threat model summary, build from source at a pinned revision, how to run every test, known limitations and NOT_RUN items.
• .github/workflows/ci.yml (new): cargo build --locked --all-targets, cargo test --locked and an SPDX SBOM artifact; actions pinned by full commit sha, permissions: contents: read.
• .github/dependabot.yml (new): monthly GitHub Actions updates and Cargo lockfile updates (lockfile-only); pull requests only, nothing merges itself.
• .crumb files recompiled with the repository's pinned crumb tool after the content changes.

Evidence

• OpenSSF Scorecard v5.6.0 on main before this change: 4.2 (commit c6e2ab3); the after score is recorded in the lane status once the branch is scanned.
• Local cargo test --locked rc=0, 26 tests (EXERCISED).
• CI results for this branch: see the checks on this pull request (none claimed here).

Levels: IMPLEMENTED = in this branch; EXERCISED = run locally with the command shown; nothing here is QUALIFIED or MERGED.

[drakestapleton]

This was generated by AI during triage.

PR desk (omp-desk, Drake 2026-10-29): returned to draft. It was marked ready during the 29 Oct org cleanup on the basis of "no required checks", but its title/body declares it a draft pending human review. Fail-closed: it stays a draft until its author or Drake asks for review; no merge label.