ci: enable workflow security dogfood

.delivery-readiness.yml

@@ -0,0 +1,9 @@
+version: 1
+recommended_checks:
+  - dependency_lock
+  - security_guidance
+  - support_guidance
+  - architecture_guidance
+  - limitations_guidance
+  - workflow_permissions
+  - action_pinning

.github/workflows/ci.yml

@@ -1,11 +1,13 @@
 name: CI
 on: [push, pull_request]
+permissions:
+  contents: read
 jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with: { node-version: '24', cache: 'npm' }
       - run: npm ci --no-fund
       - run: npm run typecheck

README.md

@@ -16,21 +16,38 @@ The rescue moves validation to the HTTP boundary, durably claims one order opera
 
 See [the root-cause analysis](docs/ROOT_CAUSE_ANALYSIS.md), [before/after evidence](docs/BEFORE_AFTER.md), and [architecture](docs/ARCHITECTURE.md).
 
-## Reproduce and validate
+## Setup
 
 Requires Node 24.
 
 ```sh
 npm ci --no-fund
+```
+
+On Windows where `npm.ps1` is blocked, `npm.cmd` is equivalent. No private cache path is required.
+
+## Run
+
+Start the local synthetic API with:
+
+```sh
+npm run dev
+```
+
+The fixed route is `POST /webhooks/orders` with `eventId`, `orderId`, and positive integer `amountCents`; `GET /health` returns service status.
+
+## Test and validation
+
+Run the deterministic verification set with:
+
+```sh
 npm run typecheck
 npm test
 npm run build
 npm audit
 ```
 
-On Windows where `npm.ps1` is blocked, `npm.cmd` is equivalent. No private cache path is required.
-
-The tests named `SYNTHETIC INTENTIONALLY FLAWED BASELINE` pass by asserting known-bad behavior. They are evidence, not approval of the baseline. The fixed route is `POST /webhooks/orders` with `eventId`, `orderId`, and positive integer `amountCents`; `GET /health` returns service status.
+The tests named `SYNTHETIC INTENTIONALLY FLAWED BASELINE` pass by asserting known-bad behavior. They are evidence, not approval of the baseline.
 
 ## Limitations