feat(security): publish-side hardening — SHA256SUMS, tags, pinned actions

[bhavink]

Summary

Publish-side security plumbing. Consume-side hardening (TF module hash verification with mock-based tests) follows in PR 4 — splitting because hash verification is cleanly testable only once SHA256SUMS is actually being published.

What changes

Workflow hardening

• update.yml — pin actions/checkout and actions/setup-python by commit SHA with version comments. Verify SHA256SUMS in-place after generation. Tag every successful publication as v<YYYY.MM.DD>. Skip tag if it already exists (multiple same-day runs).
• terraform.yml — pin actions/checkout and hashicorp/setup-terraform by commit SHA.

Integrity manifest

• update_outputs.py generates docs/output/SHA256SUMS in GNU sha256sum format (<64-hex> <filename>).
• Compatible with sha256sum -c SHA256SUMS (Linux) and shasum -a 256 -c (macOS).
• Excludes SHA256SUMS from itself (no chicken-and-egg).
• Output directory index now links the manifest and shows the verify command.

Threat model

• SECURITY.md — explicit trust boundary (5 things you trust when consuming), highest-leverage defense (pin to tag/SHA, never main), defenses already in place, recommended consumption patterns by paranoia level (default → strict → vendored), manual integrity verification recipe, reproducible-build verification recipe, honestly named out-of-scope failure modes.

Tests

• 6 new in test_update_outputs.py covering: file emitted, GNU format regex, recorded hashes match on-disk content, no self-reference, every txt file covered, index links it.
• 39/39 Python tests passing (was 33/33).
• 9/9 Terraform tests still passing.

Test plan

• python -m pytest 39/39 passing
• terraform test 9/9 passing (no regression)
• Both workflow YAMLs parse cleanly
• sha256sum -c SHA256SUMS against the locally-generated manifest succeeds for all 89 entries
• CI runs terraform.yml (pinned SHAs) on this PR
• First weekly run of update.yml post-merge generates SHA256SUMS + tags

Follow-up (PR 4)

TF module hash verification: optional verify_checksums input (default true) that fetches SHA256SUMS at plan time and compares against sha256(self.response_body) of each fetched feed via postcondition. Mock-based unit tests for the verification logic.