Milestone 7: supply-chain and CI hardening

[anthfuller]

Summary

• pin direct and transitive Python dependencies, including SHA-256 distribution hashes
• pin external GitHub Actions to verified full commit SHAs and restrict workflow authority
• add checksum-verified Gitleaks scanning, known-vulnerability auditing, and retained CycloneDX SBOM generation
• add repository-local supply-chain invariants, negative tests, Dependabot configuration, CODEOWNERS coverage, and bounded assurance documentation

Reviewed scope

• Base: d28917c7ca450205d556c1c98ac08f56cb08784b
• Head: 0c604fcb5df87aa6037ea12f8ebfde637d1b8bbd
• Tree: 9166c97975300754f16c47ab18dae8a3e7dadc05
• 13 files; 1,248 additions; 91 deletions

Validation

• 90 tests passed with checksum-verified OPA 1.20.2
• clean hash-locked installation passed
• pip-audit: no known vulnerabilities
• CycloneDX 1.4 SBOM generated with 39 components
• Gitleaks 8.30.1 full-history scan: no leaks found
• prompts, policies, allowlist, settings, contracts, strict Rego, canonical evidence/replay, golden dataset, links, YAML, whitespace, and whitepaper integrity passed

Independent review approved this exact head for PR creation. Do not merge until PR-head GitHub Actions and final review pass.