[Quality frontier] Close warranted testing and CI/CD gaps

[edithatogo]

Refined evidence

• Kind/code/tests/workflows: software / 210 / 97 / 6
• Warranted gaps: MT, Contract
• CI gaps: pinned_actions, codeql, dependency_review, workflow_lint

Done when

• Confirm applicability and document exclusions.
• Add warranted deterministic, replayable suites with bounded runtime and thresholds.
• Add least-privilege, concurrency, immutable actions, updates, linting, and applicable gates.
• Keep PR checks fast; schedule expensive lanes and retain evidence.