feat: automate detection of CI enforcement drift for security-relevant policies

### Issue Description

Track a focused initiative to automatically detect gaps where a security-relevant repository policy is documented in `.github/instructions/` but has no corresponding CI enforcement, or where existing enforcement can silently become non-blocking. This was prompted by PR #2700, which found that the workflow `runs-on` runner policy was documented in `workflows.instructions.md` but had no automated check until that PR added one — nothing had been forcing that documentation-to-enforcement gap closed.

This issue tracks the parent outcome; each concrete piece of work is a linked child issue.

### Additional Context

**Scope:** Security and regression-prevention gaps only (not stylistic/nitpick items). Explicitly out of scope: commit-message/PR-title formatting conventions and the ADR-handoff RAI disclosure requirement — neither has a security or regression impact; both are better suited to different initiatives (release-please changelog quality, RAI/responsible-AI disclosure tracking respectively).

**Children:**

* Meta-validator for documented-but-unenforced security policy (cross-references `MUST` rules in `workflows.instructions.md`, `dependency-feeds.instructions.md`, and `skill-security-model.instructions.md` against actual enforcement scripts + CI wiring + gate `needs:` membership)
* Silent soft-fail detector for security-relevant CI jobs (flags any security job whose soft-fail-equivalent toggle is `true` without an explicit allow-list comment)
* Branch-protection root-of-trust verification (confirm `pr-validation-success` is the sole required status check, not individual job names)
* Extend gate-completeness checking beyond `pr-validation.yml` to other aggregator workflows (release, plugin-validation, eval-validation)

**Precedent:** `scripts/security/Test-PrValidationGate.ps1` and `scripts/security/Test-WorkflowRunner.ps1` are the existing pattern this initiative generalizes.