ci: add OSV-Scanner scheduled CVE scanning workflow

[CGFixIT]

Summary

Rebased onto current main (da4cbd4). The pip-audit.yml this PR originally added already exists on main (from PRs #71/#72, in a superior form with SHA-pinned actions, ubuntu+windows matrix, and --ignore-vuln CVE-2026-45829). That half was dropped during rebase conflict resolution.

What remains — the one genuinely net-new file:

osv-scanner.yml

Adds Google's OSV-Scanner as a scheduled + PR-gated CVE workflow, complementing the existing pip-audit.yml on main. OSV-Scanner covers all dependency ecosystems vs the OSV.dev database and uploads native SARIF to the Security → Code scanning tab.

Trigger	Job	Behavior
pull_request	scan-pr	Differential — flags vulns introduced by the PR
schedule / push main / workflow_dispatch	scan-scheduled	Full scan, SARIF → Security tab

• Routing via if: github.event_name == ... → exactly one job runs per event; the other is skipped (neutral).
• Per-job permissions: minimum required — security-events: write, contents: read, actions: read.
• scan-args: -r ./ → recurse from repo root so every manifest/lockfile is covered.
• SHA-pinned: google/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2 (v2.3.8), verified via git ls-remote.

Why CI was red before rebase:

• invariants-gate: Old pyproject.toml TOML bug ([[tool.uv.sources]]) — fixed in da4cbd4 on main, resolved by rebase.
• ubuntu/windows coverage: Branch had old test state (54 tests / 56% coverage) — resolved by rebase to current main (119 tests).
• pip-audit true positive: Old pip-audit.yml without --ignore-vuln — resolved by rebase (main's version now applies).

Net diff on current main: osv-scanner.yml only — 53 insertions. No runtime, topology, or invariant changes. No secrets required.

Note: Can be merged before or after PR #73 (constraints.txt header) — no overlap between the two.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.