<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #41198 

Subsequent PRs will clean up existing failures to enable more checks.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added automated security scanning for repository
workflow/configuration changes and pull requests, with manual trigger
and concurrent-run cancellation.
* **Chores**
* Introduced a configurable audit gate to suppress backlog rules with
guidance for removal.
* Enabled runner hardening, pinned tool versions, read-only checkout,
annotation-enabled reporting, and limited-scope analysis for workflow
files.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->