feat(security): establish continuous security assurance

[alangou]

Problem Statement

OpenShell has useful controls, including protected CI paths, Dependabot for GitHub Actions, scheduled cargo-deny, partial SBOM generation, and artifact attestations. Coverage is fragmented across languages, deployment assets, and published artifacts.

Impact / Why This Matters

OpenShell is a security-sensitive open source runtime. Manual and disconnected checks do not scale or provide maintainers and users with repeatable evidence that a release was fully assessed.

Proposed Design

Deliver the roadmap as independently reviewable changes:

• Repository and PR gates: tighten ownership and workflow permissions; add dependency review, CodeQL, Zizmor/actionlint, secret scanning, push protection, and expiring exceptions.
• Dependencies and deployment: expand Dependabot; retain cargo-deny; use Trivy only for final images and IaC, including Helm defaults, supported value profiles, and the packaged chart.
• Codex Security: scan cumulative diffs nightly and periodically run a full scan. Convert validated findings into deduplicated private draft GitHub Security Advisories. Keep raw output ephemeral; PSIRT controls confirmation, remediation, CVE requests, and publication.
• Release assurance: build on docs(rfc): define stable release policy #2695 and feat(build): embed auditable Rust dependency metadata #2734; generate per-artifact CycloneDX SBOMs, provenance, and signatures; qualify release candidates by digest and promote without rebuilding.
• Security testing: add focused coverage with cargo-fuzz, OSS-Fuzz, proptest, Miri, ASan/UBSan, abuse-case E2E tests, OpenSSF Scorecard, OSPS, and SLSA assessment.

Run relevant gates on pull requests and merge groups, Codex Security nightly, supported-image rescans every six hours, full static/IaC/posture checks weekly, and artifact checks for every release.