[Quality frontier] Close warranted testing and CI/CD gaps

[edithatogo]

Refined evidence

• Kind/code/tests/workflows: software / 52 / 21 / 6
• Warranted gaps: Property-based, Mutation, MT, Contract
• CI gaps: pinned_actions, dependency_review, secret_scan

Done when

• Confirm applicability and document exclusions.
• Add warranted deterministic, replayable suites with bounded runtime and thresholds.
• Add least-privilege, concurrency, immutable actions, updates, linting, and applicable gates.
• Keep PR checks fast; schedule expensive lanes and retain evidence.

[edithatogo]

Resolved by #230/#231. The repository now has generated literal-preservation properties, portable/host contracts, deterministic Node-native coverage with thresholds/artifacts, pinned actions, least-privilege defaults, CodeQL plus the shared blocking gate, and enabled secret scanning/push protection. Mutation testing is explicitly excluded after bounded evaluation because this small filesystem/process-heavy surface would add more dependency/configuration burden than demonstrated blind-spot value. Dependency review is not added because the package is private/dev-tooling-only and npm audit plus Dependabot provide the warranted dependency gate.