security: establish OpenSSF foundation

[cdeust]

Summary

• establish the repository's OpenSSF foundation with CodeQL, Scorecard,
  Dependabot, read-only workflow defaults, full-SHA action pins, and a
  hash-locked Python test environment
• measure the shipped Python surface in subprocesses and enforce an 80% floor;
  add hook, transcript, portable-tooling, and release-integrity regression tests
• add a least-privilege tagged-release workflow that produces a verified source
  bundle, executable manifest, CycloneDX SBOM, SHA-256 companions, and Sigstore
  provenance attestations
• publish security, contribution, conduct, governance, architecture,
  assurance-case, Scorecard, and twelve-month roadmap documents
• add an evidence dossier that separates the credential-free MIT fork
  continuity path from the still-unmet bus-factor and signed-release facts

The transcript tests found and fix one real parser defect: valid compact-summary
JSON containing ordinary whitespace was skipped by the prefilter.

Cross-platform sequencing

This branch is stacked on #15 so the security documents describe the same
Codex/Gemini/Claude boundary under review there. Merge #15 first; GitHub will
then reduce this PR to the OpenSSF commit.

Verification

• coverage run -m pytest -q && coverage combine && coverage report: 50
  passed; 712 statements, 42 missed, 94%
• statusline shell suites: 22 + 53 passed
• release bundle build and verifier: passed, including tamper and path-traversal
  rejection
• ShellCheck 0.11.0: no findings over shipped/test/release shell
• actionlint 1.7.12: no findings
• JSON and YAML parse checks: passed
• git diff --check: passed

The downloaded local ShellCheck and actionlint archives were checked against
the SHA-256 digests published by the corresponding GitHub release API before
execution.

Honest remaining gaps

• OpenSSF Best Practices achieve_passing: unmet until the project is
  registered and the live questionnaire is verified
• Silver signed_releases: unmet until a new public tag successfully exercises
  the workflow and its attestation is independently verified
• Scorecard bus factor: 1 because @cdeust is the only administrator of the
  original repository; OpenSSF access continuity is satisfied separately by a
  documented MIT fork path that needs no original key, token, domain, private
  dependency, or legal assignment to manage issues, accept changes, and release

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.