[P0] **Repository and PR gates:** tighten ownership and workflow permissions; add dependency review, CodeQL, Zizmor/actionlint, secret scanning, push protection, and expiring exceptions.

[alangou]