feat(security): land Engram 10/10 wave 3 foundations

[limaronaldo]

Summary

• harden HTTP client identity with bounded trusted-proxy handling and request resource controls
• require an aggregate security and supply-chain gate without changing branch protection
• add a canonical real-binary stdio/authenticated-HTTP journey against one shared isolated database
• freeze a deterministic retrieval-quality corpus and smoke-test primary examples
• record Wave 3 integration and independent review remediation in harness live state

Verification

• make ci
• full docs/harness/bin/sensors.sh with no exclusions
• trusted-proxy HTTP security tests
• aggregate security-gate self-tests and workflow lint
• canonical journey: 8/8, including HTTP read-back of stdio-updated state
• retrieval-quality tests: 3/3
• deterministic example smoke and negative self-test
• harness doctor and live-state checker
• independent review: REVIEW_VERDICT: PASS

Boundaries

• atomic descriptor-bound SQLite opening remains deferred to its dedicated native-shim/audited-VFS follow-up
• no tag, release, deployment, registry publication, branch-protection write, or channel approval occurred

[huly-for-github]

Connected to Huly®: ENGRA-227