Add supply-chain scanning, SBOMs, and release provenance

[0xzr]

Goal

Add automated security evidence for Python dependencies, GitHub Actions workflows, source code, and published container/package artifacts.

Scope

• Add CodeQL or an equivalent Python static-analysis workflow.
• Add dependency vulnerability scanning with pip-audit or OSV.
• Scan the built container with Trivy or an equivalent scanner.
• Audit GitHub Actions workflow security and pin third-party actions according to repository policy.
• Generate SPDX or CycloneDX SBOMs for release artifacts and container images.
• Publish GitHub artifact attestations or equivalent provenance for release builds.
• Consider pinning the Python container base image by digest with automated updates.
• Define severity thresholds and an explicit exception process.

Acceptance criteria

• Pull requests receive actionable source, dependency, workflow, and container findings.
• High/critical findings fail the relevant release or merge gate unless a documented exception exists.
• Release wheels, source archives, and images have downloadable SBOMs.
• Published container images and package artifacts have verifiable provenance.
• Scanners use least-privilege permissions and do not upload repository secrets.
• Tests/documentation explain local reproduction and false-positive handling.