feat(ci): CI/prek hardening batch — slim pre-push, yarn-flag fix, scoped allowlists, hermetic semgrep, issue dedup

> **Filed during the ABCA validation-loop CI/CD review** (Bonk, 2026-06-12). Batch of low-effort, independently-shippable hardening fixes surfaced by the review + Fable-5 cross-check, each verified against the configs at `1faa5c3`. Sibling to the keystone #327 (required-check enforcement) and the single-source-of-truth issue; these can land in any order after #327, but each is small enough to batch.

### Component

Tooling / CI

### Describe the fixes

Each is an afternoon or less. Grouped so they can ship as one PR or be split.

**1. Slim the pre-push hook so it stops manufacturing `--no-verify` culture.** `hooks:pre-push:security` runs the full `mise run security` (gitleaks full-history + osv + 5 semgrep rulesets + grype filesystem + retire ×3 + zizmor + agent bandit/trivy), and `hooks:pre-push:tests` runs all three suites — plausibly 5–15 min per `git push`. Humans facing that use `--no-verify`; they already did, and shipped account IDs (#313). Cut pre-push to ≤90s: range-scoped secrets (`gitleaks git --log-opts="origin/$(git merge-base origin/main HEAD)..HEAD"`), `semgrep --baseline-commit origin/main` on changed files, affected-package tests only. The heavy suite belongs in the required CI checks (#327), where bypass is impossible.

**2. Fix the Yarn flag mismatch.** No `packageManager` / `.yarnrc.yml` / `.yarn/releases` ⇒ this is Yarn 1 (classic). All mise tasks use the Yarn-1 `--check-files` (`mise.toml:38`, `cdk/cli/docs mise.toml`), but `deploy.yml:167,247` use the Yarn-Berry `--immutable`. One flag is wrong for whichever yarn is canonical. Standardize on one and use its immutable/frozen-lockfile flag in **all** CI install paths, so a PR with lockfile drift fails fast with a clear error instead of being silently rewritten and caught only by the end-of-build self-mutation diff.

**3. Scope the `.gitleaks.toml` stopword allowlists.** Allowlists 2 and 3 (`stopwords = ["wat-opaque-123"]`, `["test-signing-secret-abc123"]`) have no `paths` and no `targetRules` — they suppress any matching finding in any file against any rule. Add `paths` (the specific test files) and `targetRules` to both, matching the disciplined first allowlist (PEM fixtures). Add a review convention: allowlist entries require `paths`. (This is the pattern an agent will copy to silence its own leak — see #327 §E.)

**4. Add a `concurrency` group to `build.yml`.** It has none (contrast `security.yml`, `deploy.yml`). Agents push in bursts → N stale builds per PR, and since `deploy.yml` triggers on `workflow_run` completion, on a `deploy`-labeled PR an older build finishing last can deploy a stale artifact. `concurrency: { group: build-${{ github.event.pull_request.number || github.ref }}, cancel-in-progress: true }` — but do **not** cancel `merge_group` runs once #327 adds that trigger.

**5. Make semgrep hermetic.** `security:sast` uses `--config auto`, which requires network, sends metrics to semgrep.dev, and resolves rules dynamically (gate behavior changes with no diff). The task already passes five explicit registry configs. Drop `--config auto`, add `--metrics=off`.

**6. Deduplicate `security.yml`'s failure-issue creation.** The "Open issue on failure" step unconditionally `gh issue create --label bug` on every failing run, so a persistent failure (like the current #313/leak state) files a fresh near-duplicate weekly — noise that spawns duplicate agent fix-PRs. Search for an open `security-suite`-labeled issue and comment instead of creating; use a dedicated label, not `bug`.

**7. Add `astro check` to the PR build.** Root `//docs:build` runs `astro build` (`docs/mise.toml`), not `astro check` — so docs type/content diagnostics don't gate PRs. Add `//docs:check` to the build DAG (or the new docs CI). _(Verified the TS side is fine: `cdk:build`/`cli:build` both depend on `:eslint`, so eslint does run on PRs.)_

**8. Tighten small-workflow least-privilege + dead code.** (a) `docs.yml` build job has `pages: write` + `id-token: write` but only checks out and builds — move both to the deploy job. (b) `pull-request-lint.yml:18` has `if: github.event_name == 'pull_request' || ...` but triggers only on `pull_request_target`, so the `pull_request` arm is dead. (c) `docs.yml` paths list `docs/guides/**` and `docs/design/**` redundantly under `docs/**`.

### Acceptance criteria

- [ ] Pre-push hook completes in ≤90s on a typical change (range-scoped secrets + baseline semgrep + affected tests).
- [ ] One Yarn flavor is canonical; all CI install steps use its immutable-lockfile flag; lockfile drift fails fast.
- [ ] Both `.gitleaks.toml` stopword allowlists carry `paths` + `targetRules`.
- [ ] `build.yml` has a `concurrency` group that does not cancel `merge_group` runs.
- [ ] `security:sast` drops `--config auto` and sets `--metrics=off`.
- [ ] `security.yml` failure issues are deduplicated onto a single open issue with a dedicated label.
- [ ] `astro check` runs on PRs.
- [ ] `docs.yml` permissions scoped to the deploy job; dead `if` and redundant paths removed.

### Other information

Source: ABCA validation-loop CI/CD review (Bonk + Fable-5, 2026-06-12). Effort: **S** (each item); whole batch **S–M**. Per ADR-003 this issue needs the `approved` label before work begins. Split into per-item PRs if preferred.