chore: improve enterprise security assessment and dependency evidence

[marianfoo]

Goal

Help enterprise customers assess ARC-1 and its dependencies, especially when they clone the repository and deploy to SAP BTP. Provide prominent security documentation, usable source evidence, and a documented rollout for security-only merge requirements.

Changes

• Promote Security & Trust in the documentation with an overview, dependency evidence, hardening guidance and a plain-language assessment with a copyable approval record.
• Separate high/critical dependency security checks from existing license policy, cover runtime/development/unknown scopes, and pin the verified Dependency Review action.
• Provide a disabled ruleset for Dependency security and high/critical CodeQL security findings. Preserve Release Please's existing token and publication behavior; document native workflow approval for bot-created PRs.
• Add npm run security:evidence: full/production root and AppRouter inventories, audits, hashes, source identity, readable results and a customer staging worksheet. No project dependency installation or lifecycle scripts are needed; unavailable results remain incomplete.
• Add scheduled/manual evidence collection, minimal Socket configuration, an implementation plan and a maintainer activation/rollback/triage runbook. Record verified Socket Business entitlement, root/AppRouter/auth-repository coverage, the current Standard baseline, and all five active ARC-1 alerts with review priorities.

Review corrections

• Fix silent CLI success through symlinked files and checkout paths. Reject empty MTAR/output arguments and unsupported SBOM versions.
• Allow new output directories inside the checkout without counting generated reports as source changes. Exclude only files produced by that run; unrelated changes still fail --require-clean. Ignore MBT's generated root Makefiles.
• Make the workflow contract reject quoted warn-only: 'true', which would otherwise disable vulnerability gating.
• Document the GitHub default-setup exception for Dependabot. A neutral CodeQL status alone does not establish a merge deadlock. Keep the template disabled and verify code, documentation, human dependency-only, Dependabot, fork and release PRs before activation.
• Verify with real npm that conflicting active version overrides already make SBOM collection incomplete. Keep denied-license findings visible through a failed non-required check and its Actions summary; document human review.
• Remove a remaining customer-docs reference to an optional Release Please App.

Validation

• 5,803 local tests across 196 files passed, including 34 focused collector/workflow/release tests.

• All 31 collector/workflow tests also passed with pinned npm 11.11.1. A deliberate quoted warn-only mutation failed the contract test as intended and was reverted.

• Type checking, repository lint, strict MkDocs build and whitespace checks passed.

• Exact commit 3c250c2cda7ccfbc84426a3b7a335b78e46165b8 collected all six reports with npm 11.11.1 from a clean isolated checkout, through a symlink, with an unignored output directory and an MBT Makefile fixture. Exit 0, unchanged source inputs, clean source status, zero high/critical findings. No project dependencies were installed. The temporary checkout was removed after retaining the evidence.

• Release PR chore(main): release 1.3.0 #751 shows GitHub's native action_required workflow wait. Execution after approval remains to be verified; do not manually dispatch Release as a test because that path publishes npm.

• GitHub checks passed on 3c250c2c: Node 22/24, Dependency security, Dependency licenses, CodeQL (all three analyses), Socket project/PR checks, documentation and MTA validation. Live SAP jobs skipped under the existing chore policy; no SAP runtime behavior changes.

• Documentation-only follow-up 3c48b03a updates the verified Socket account state and rollout instructions. Strict MkDocs build and whitespace checks passed. All applicable GitHub checks also passed on this head, including Node 22/24, Dependency security/licenses, CodeQL, Socket, documentation and MTA validation; GitHub reports CLEAN and MERGEABLE. No account policy or alert resolution was changed.

Activation boundaries

This PR leaves the ruleset disabled. After merging, verify applicable current PR results and actual merge behavior before enabling it, approving bot-created workflows when prompted. Socket Business is approved; dashboard policy and blocking behavior still need calibration before requiring its check. No new mandatory test/lint/build/license checks or changes to release publication gates are introduced. Source evidence does not inventory the customer's final CF droplet, buildpack or OS.

Plan: docs/plans/2026-09-07-enterprise-security-implementation.md.