feat: prod-readiness PR 3 of 5 — supply chain & bundle integrity #76

Job	Run time
OSV-Scanner (SCA)	7s
jscpd (duplication < 3% on touched code)	15s
Semgrep (SAST)	28s
Gitleaks (secret scan)	12s
SBOM (SPDX + CycloneDX)	8s
Trivy (filesystem + container scan)	28s
	1m 38s

Provide feedback