feat(security): establish continuous security assurance

Problem Statement

OpenShell has useful controls, including protected CI paths, Dependabot for GitHub Actions, scheduled cargo-deny, partial SBOM generation, and artifact attestations. Coverage is fragmented across languages, deployment assets, and published artifacts.

Impact / Why This Matters

OpenShell is a security-sensitive open source runtime. Manual and disconnected checks do not scale or provide maintainers and users with repeatable evidence that a release was fully assessed.

Proposed Design

Deliver the roadmap as independently reviewable changes:

• [P0] Repository and PR gates: tighten ownership and workflow permissions; add dependency review, CodeQL, Zizmor/actionlint, secret scanning, push protection, and expiring exceptions.
• [P0] Release assurance: build on #2695 and #2734; generate per-artifact CycloneDX SBOMs, provenance, and signatures; qualify release candidates by digest and promote without rebuilding.
• [P1] Codex Security: scan cumulative diffs nightly and periodically run a full scan. Convert validated findings into deduplicated private draft GitHub Security Advisories. Keep raw output ephemeral; PSIRT controls confirmation, remediation, CVE requests, and publication.
• [P2] Security testing: add focused coverage with cargo-fuzz, OSS-Fuzz, proptest, Miri, ASan/UBSan, abuse-case E2E tests, OpenSSF Scorecard, OSPS, and SLSA assessment.

Run relevant gates on pull requests and merge groups, Codex Security nightly, supported-image rescans every six hours, full static/IaC/posture checks weekly, and artifact checks for every release.