chore(security): bootstrap sscs-bootstrapper and close the gaps it found

.github/CODEOWNERS

@@ -1,13 +1,30 @@
 # CVM Supply Chain Security — CODEOWNERS
-# Changes to CI/CD, security config, and dependency policy require security team review.
+# Changes to CI/CD, security config, and dependency policy require security review.
+#
+# OWNER CORRECTION (2026-09-12): every rule in this file previously named
+# @grcengineering/security, a team that does not exist. GitHub's own
+# `GET /repos/grcengineering/cvm/codeowners/errors` returned "Unknown owner" for
+# all ten lines, which means NO rule matched anyone and the file was inert —
+# including the branch-protection "require review from Code Owners" path.
+# Rules now name @p4gs, who has admin on this repository, so they actually bind.
+# If a real @grcengineering/security team is created (publicly visible, with
+# write access here), swap the owner back and re-check the errors endpoint.
 
-.github/workflows/         @grcengineering/security
-.github/actions/           @grcengineering/security
-.github/CODEOWNERS         @grcengineering/security
-.github/dependabot.yml     @grcengineering/security
-renovate.json              @grcengineering/security
-deny.toml                  @grcengineering/security
-rust-toolchain.toml        @grcengineering/security
-Dockerfile                 @grcengineering/security
-SECURITY.md                @grcengineering/security
-supply-chain/              @grcengineering/security
+.github/                   @p4gs
+.github/workflows/         @p4gs
+.github/actions/           @p4gs
+.github/CODEOWNERS         @p4gs
+.github/dependabot.yml     @p4gs
+renovate.json5             @p4gs
+deny.toml                  @p4gs
+rust-toolchain.toml        @p4gs
+Dockerfile                 @p4gs
+SECURITY.md                @p4gs
+supply-chain/              @p4gs
+
+# sscs-bootstrapper policy surface — the files that decide which controls run,
+# who may sign, and which packages are approved. Treat as security config.
+.sscsb/                    @p4gs
+security-insights.yml      @p4gs
+.trufflehog.yaml           @p4gs
+Cargo.lock                 @p4gs

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,34 @@
+<!-- sscsb AI-provenance PR template -->
+## Summary
+
+<!-- What does this PR change and why? -->
+
+## AI Provenance Declaration
+
+<!-- Answer honestly — reviewers scale their scrutiny from these answers.
+     The commit-level equivalents are the AI-Assisted/AI-Tool/AI-Model/AI-Role trailers. -->
+
+- [ ] AI generated or assisted with **code** in this PR
+- [ ] AI generated or assisted with **tests** in this PR
+- [ ] AI introduced or suggested **new dependencies** in this PR
+- [ ] AI generated or assisted with **documentation** in this PR
+
+**AI tool(s)/model(s) used (if any):**
+
+**Human review performed on AI-generated parts (what/how):**
+
+## Dependency Changes
+
+<!-- If new dependencies were added (especially AI-suggested ones):
+     - `sscsb deps check` output attached?
+     - packages verified to exist on their registry (anti-slopsquat)?
+     - `sscsb deps approve <eco>:<name>` recorded in .sscsb/policy/packages.toml? -->
+
+- [ ] No new dependencies
+- [ ] New dependencies validated (`sscsb deps check`) and approved
+
+## Merge Policy Reminder
+
+Merges to protected branches must be signed by an approved **human** hardware-backed
+key. When AI involvement is declared above, the merge commit needs review
+evidence (`Reviewed-by:` trailer). See `docs/signing.md`.

.github/chainguard/sscsb-automation.sts.yaml

@@ -0,0 +1,26 @@
+# sscsb Octo STS trust policy — lives at .github/chainguard/sscsb-automation.sts.yaml
+# in the repo that GRANTS access. Workflows in `subject_pattern` below can
+# exchange their OIDC identity for a short-lived token with EXACTLY these
+# permissions on THIS repo. No PAT, nothing stored, expires in ~1 hour.
+#
+# Docs: https://github.com/octo-sts/app
+issuer: https://token.actions.githubusercontent.com
+
+# Which workflow identities may federate. GitHub's OIDC `sub` claim is
+# ID-DECORATED — `repo:OWNER@<owner_id>/REPO@<repo_id>:ref:refs/heads/main` —
+# so a pattern spelled from names alone never matches (Octo STS refuses with
+# `subject "repo:OWNER@123/REPO@456:ref:…" did not match "repo:OWNER/REPO:ref:…"`).
+# The `(@<id>)?` groups accept both the bare and the decorated form; the ids
+# are what survive a rename and what a re-created repository of the same name
+# does NOT share, so pin them (sscsb fills them in from the GitHub API when
+# `gh` is available; otherwise `[0-9]+` accepts any id until you replace it):
+#   gh api repos/grcengineering/cvm --jq .id   → repo id
+#   gh api users/grcengineering --jq .id       → owner id
+# `.` in the repository name is escaped: this is a regular expression.
+subject_pattern: 'repo:grcengineering(@155832502)?/cvm(@1201601113)?:ref:refs/heads/main'
+
+permissions:
+  # Least privilege: grant only what the automation needs.
+  contents: read
+  # issues: write
+  # pull_requests: write

.github/workflows/codeql.yml

@@ -0,0 +1,52 @@
+# sscsb: CodeQL — deep interprocedural analysis on PRs and the default branch.
+#
+# sscsb's template ships `actions` only and tells you to add your own languages,
+# because CodeQL that does not read your source code is not analysing your
+# source code. This workspace is Rust (9 crates under crates/), so `rust` is
+# added alongside `actions`.
+#
+# build-mode: none for both. Rust extraction is source-based and does not build
+# the crate graph; `actions` supports no other mode.
+name: CodeQL
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+  schedule:
+    - cron: "45 3 * * 2"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build-mode: none
+          - language: rust
+            build-mode: none
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+      - name: Analyze
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        with:
+          category: "/language:${{ matrix.language }}"