safety: add dependency-vulnerability scanning across the fleet

[lorenzoliuzzo]

Part of the fleet milestone (#1 §4 "Safety/process gaps").

Gap

No dependency-vulnerability scanning anywhere in the fleet: no Dependabot
config, no pip-audit/osv-scanner/CodeQL in any repo's CI. Every repo pulls
mythings-core + a small dep set; one compromised transitive dependency has no
automated tripwire today.

Do

• Add a shared CI step (pip-audit or osv-scanner) — ideally a reusable
  workflow in .github so all repos inherit it, not N copies.
• Enable Dependabot (or Renovate) for pip + github-actions.
• Decide fail-vs-warn policy (warn first, then gate).

Acceptance

At least one repo scanning on PR, and a documented rollout path to the rest.