ci-compliance-guardrails: secret scanning, SAST, and required-check branch protection #328

Tracking issue for the platform-chore-328-compliance-guardrails OpenSpec change.

One task group = one sub-issue = one PR, merged before the next group starts. This issue holds no task list of its own — see the sub-issues below.

• Group 1: Secret scanning pilot (gitleaks) on budget + repo-wide pre-commit hook — compliance-guardrails: Secret scanning pilot (gitleaks) on budget + repo-wide pre-commit hook (group 1) #329
• Group 2: Bandit SAST pilot on budget — compliance-guardrails: Bandit SAST pilot on budget (group 2) #330
• Group 3: Semgrep custom rules (PII-in-logs, raw-SQL) pilot on budget — compliance-guardrails: Semgrep custom rules (PII-in-logs, raw-SQL) pilot on budget (group 3) #331
• Group 4: Roll out gitleaks + Bandit + Semgrep (PII/SQL rules) to remaining services — compliance-guardrails: Roll out gitleaks + Bandit + Semgrep (PII/SQL rules) to remaining services (group 4) #332
• Group 5: Tenant-scoping Semgrep rule (narrow scope, all services) — compliance-guardrails: Tenant-scoping Semgrep rule (narrow scope, all services) (group 5) #333
• Group 6: Promotion tracking + documentation — compliance-guardrails: Promotion tracking + documentation (group 6) #334
• Group 7: Promote checks to required + enable branch protection — compliance-guardrails: Promote checks to required + enable branch protection (group 7) #335

Artifacts: openspec/changes/platform-chore-328-compliance-guardrails/ (proposal.md, design.md, tasks.md).