v0.5.0 — Vulnerability and malware scans, GuardWords hook

Three new surfaces. The vulnerability scan (vuln-scan-pulse-oss.yml) runs NVIDIA's Pulse OSS scanner against a disposable copy of the checkout and reports to nSpect over a Charon tunnel. The malware scan (malware-scan-pulse.yml) asks the Pulse Malware Service to scan the run's own commit with ReversingLabs — nothing is checked out, and the target cannot be redirected. The GuardWords pre-commit hook (guardwords-scan-code-scanning) sends the staged diff to NVIDIA's internal code-scanning service and skips for anyone without it, so external contributors are never blocked.

Additive. Existing suite callers need no change: enable-vuln-scan and enable-malware-scan default to false, and both scans' permissions are already inside the suite's permission union. Both scans require a Charon tenant grants the Pulse backends and lists every ref they scan from.

Full notes: CHANGELOG.md