feat: harden pip supply chain and add OCI labels to security image

Summary

Follow-up from PR #86 review (Kimi-2.6). Two improvements for the
security container image before production OpenShift deployment.

1. pip hash verification

semgrep and bandit are version-pinned but installed without hash
verification. Use pip install --require-hashes -r requirements.txt
with a generated lock file to close the supply chain gap.

This requires hashing all transitive dependencies (~50 packages for
semgrep), so it was deferred from the initial PR.

2. OCI labels and HEALTHCHECK

Add standard OCI metadata labels (org.opencontainers.image.source,
.version, .description) and a HEALTHCHECK instruction for
production runtime visibility.

Note: Kubernetes deployments typically configure liveness/readiness
probes in the deployment manifest, so HEALTHCHECK is lower priority
than OCI labels for image inventory and SBOM generation.

Related

• #86 — initial security image PR
• #85 — security image issue

Start by reading the security image build definition and requirements.txt, then review PR #86 and the related issue #85 for the current image setup. Determine how the pinned semgrep and bandit dependencies are locked and where image metadata is defined. Done means reproducible hash-verified installation plus the requested OCI labels and HEALTHCHECK, with deployment behavior unchanged.