[Security] Remove build-baseline download-artifact Buffer exposure

[seonghobae]

Summary\n\nTrack the adjacent .github/workflows/build-baseline.yml artifact-download exposure that still uses actions/download-artifact in a path that can inherit the same transitive Buffer() deprecation warning class remediated for OSSF Scorecard in #199/#200.\n\n## Context\n\n- Parent stabilization program: #194\n- Related closed warning slice: #199\n- Remediation pattern: PR #200 kept the pinned action but used skip-decompress: true plus a repo-owned safe extractor for the expected artifact contents, with supply-chain guards and regression tests.\n- Adjacent exposure: .github/workflows/build-baseline.yml release artifact download around line 297.\n\n## Acceptance Criteria\n\n- Capture fresh default-branch/build-baseline warning evidence before changing the workflow.\n- Classify whether this path emits the same actions/download-artifact/Buffer() warning or remains latent exposure only.\n- If actionable, remove the root warning path without broad log filtering or weakening action pinning/digest validation.\n- Add or update repo-owned guard/test coverage so the warning-prone workflow pattern does not silently return.\n- Re-run the smallest local verification plus PR/default-branch build-baseline evidence after merge.\n\n## Security Notes\n\nArtifact downloads and archive extraction are untrusted supply-chain boundaries. Any remediation must preserve strict expected-file validation, path traversal protection, symlink rejection where archives are decompressed by repository code, immutable workflow action pinning, digest validation, and warning-free CI evidence.

[coderabbitai]

🔗 Related PRs

#58 - fix(ci): remove unverified Syft download in SBOM workflow [merged]
#190 - fix: enforce OSSF Scorecard publish constraints [merged]
#193 - docs: clarify supply-chain warning triage [merged]
#198 - Fix Scorecard SARIF upload warnings [merged]
#200 - Harden Scorecard artifact extraction [closed]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[seonghobae]

Closed by PR #202: https://github.com/seonghobae/bandscope/pull/202\n\nPost-merge evidence on develop at a328295:\n- build-baseline run 25222712541 succeeded, including macOS amd64/arm64 and Windows amd64/arm64 gates.\n- ci run 25222712512 succeeded.\n- ossf-scorecard run 25222712509 succeeded.\n- release run 25222712505 succeeded.\n- sbom run 25222712522 succeeded.\n- security-audit run 25222712495 succeeded.\n- codeql run 25222712494 succeeded.\n- trivy run 25222712532 succeeded.\n- Local post-merge log scan across those 8 runs found 0 matches for DEP0005, Buffer(), or DeprecationWarning.\n\nNote: a broader warning scan still sees pre-existing platform/tool output such as git default-branch hints, CodeQL diagnostic query labels, and Scorecard SARIF warning severities; those are not the artifact decompression DEP0005 path fixed here.