Parity round 2: lock:check, test hardening, workflow security, CodeQL, tag gate

[clintmod]

Stacked on #36 (retargets to master when it merges). Closes #37 — the remaining applicable checks from git-auto-merge PR #12.

• lock:check — uv lock --check as its own row; catches pyproject/uv.lock drift
• Test hardening — pytest-randomly (all 84 tests pass under random order), pytest-timeout (60s), and branch coverage. Branch coverage immediately exposed that the selective -t paths in backup()/restore() were never tested with an actual selection — added tests for both. Those new tests then exposed a latent bug in the legacy test signatures: @patch decorators inject bottom-up, and test_backup/test_restore had their first two mock parameter names swapped (invisible when asserting everything-was-called). Fixed. Coverage: 97.02% branch, floor stays 95.
• Workflow security — zizmor added to lint:actions (now clean: was 8 medium artipacked findings); all actions SHA-pinned with version comments (dependabot keeps bumping them); least-privilege permissions: contents: read everywhere; persist-credentials: false on every checkout; release tag moved to env-var indirection in run blocks (template-injection hygiene)
• CodeQL — python analysis on PRs, master pushes, and weekly
• Tag/version gate — release-verify now asserts version.py == release tag before testing the install (v1.0.27's match was manual luck; now enforced)

rite check (now includes lock:check) green end-to-end locally.

🤖 Generated with Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.