ci: harden supply-chain monitoring

[WalksWithASwagger]

Closes #331

Summary

• pin all 14 active GitHub Action references to immutable upstream release commits with release-tag comments
• add weekly grouped Dependabot monitoring for root npm, frontend npm, pip, and GitHub Actions without auto-merge
• add least-privilege CodeQL analysis for Python and JavaScript/TypeScript plus pull-request dependency review
• protect pins, permissions, triggers, ecosystems, YAML parsing, and provider-free boundaries with structural tests

Acceptance Self-Check

• Every active uses reference is a 40-character SHA with a reviewed release tag
• Four weekly grouped Dependabot surfaces cover root npm, frontend npm, pip, and GitHub Actions
• No auto-merge behavior or write automation was added
• CodeQL runs for Python and JavaScript/TypeScript on pull requests, main pushes, and weekly schedule
• Dependency Review runs on pull requests with contents: read and fails on high-severity additions
• CodeQL has only contents: read plus the required security-events: write upload permission
• No provider credential or deployment boundary was introduced

Action Provenance

All selected releases are upstream non-draft, non-prerelease tags, and each listed commit has a valid GitHub signature.

• actions/checkout v6.1.0: d23441a48e516b6c34aea4fa41551a30e30af803 — https://github.com/actions/checkout/releases/tag/v6.1.0
• actions/setup-node v6.5.0: 249970729cb0ef3589644e2896645e5dc5ba9c38 — https://github.com/actions/setup-node/releases/tag/v6.5.0
• actions/setup-python v6.3.0: ece7cb06caefa5fff74198d8649806c4678c61a1 — https://github.com/actions/setup-python/releases/tag/v6.3.0
• gitleaks/gitleaks-action v3.0.0: e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e — https://github.com/gitleaks/gitleaks-action/releases/tag/v3.0.0
• github/codeql-action v4.37.1: 7188fc363630916deb702c7fdcf4e481b751f97a — https://github.com/github/codeql-action/releases/tag/v4.37.1
• actions/dependency-review-action v5.0.0: a1d282b36b6f3519aa1f3fc636f609c47dddb294 — https://github.com/actions/dependency-review-action/releases/tag/v5.0.0

Gitleaks v3 is the upstream documented Node 20 to Node 24 runtime-only migration with unchanged inputs, outputs, and behavior. Existing checkout and setup action families remain on their current v6 major lines.

Verification

• focused workflow suite: 24 passed
• npm run verify: 561 Python tests and 7 frontend tests passed; build, portal E2E, docs, public boundary, dry-run smoke, package boundary, and doctor passed
• npm run verify:security: all four audits passed with zero known vulnerabilities
• all GitHub automation YAML parsed successfully
• CodeQL default setup is not configured, so the advanced workflow does not conflict with an existing setup
• dependency graph is live and returned a 726-package SPDX 2.3 SBOM
• Varlock environment audit and staged secret scan passed
• git diff checks passed and the worktree is clean

Human Checkpoint

Maintainer review of the six action provenance receipts is required before merge. Branch-protection settings remain unchanged; CodeQL and Dependency Review begin as reporting checks until a maintainer separately decides whether to require them.

[github-actions]

Agentic PR Review

Verdict: review-ready

Checks:

• Linked issue via Closes #... or Refs #...: yes
• Issue acceptance criteria found: 7
• PR verification section present: yes
• PR acceptance self-check present: yes
• Diff within v1 limits: yes

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.