[iperev]

Stacked PR 16 — base: #70 (chore/toolchain-qualification). Do not merge yet. Review only the top commit.

Context

CI-064 requires neutral export content, Apache-2.0 and third-party obligations, secret scans, a telemetry/retention statement and no private artifacts in the export. A source inventory at a1966f6 found no leaked private markers. However, nothing guarded against future leaks, NOTICE didn't cover image contents, and there was no telemetry statement.

What changed

• The protected Gitleaks policy gains the additive workstation-home-path rule (macOS and Windows home paths with a user segment; Linux paths excluded). It has one exception for the upstream Grype placeholder, tied to its value, rule and file path. Native positive, negative, wrong-file, changed-value and history witnesses are added.
• NOTICE names the third-party contents of built images.
• SECURITY.md states the telemetry and data-retention boundary.
• The portability doc records:
  • the inventory and the guard's limits;
  • the outbound-connection inventory, including browser navigation to the configured Keycloak issuer for sign-in and sign-out and to GitHub OAuth;
  • the provider-side items.
• The CI-064 ROADMAP row is updated.
• Provisional owner decision (2026-10-11): no dependency licence allow/deny policy; obligations are met through the SBOM plus NOTICE.

Expected result

The secret scan rejects newly added workstation home paths in the tree and in PR/merge-group history ranges. Existing secret rules and exceptions are unchanged.

This PR does not claim:

• general detection of private content (names, identifiers, hostnames, images);
• that the image SBOM covers UI bundle licences, or that their licence notices survive minification;
• any legal decision;
• any provider setting (secret scanning, push protection, visibility) or published-history fact;
• that the native witnesses have run;
• closure of CI-064 or CI-070.

Independent review: gpt-6-astra (xhigh); findings addressed or rejected with reasons in the single commit. Provisional owner decisions (2026-10-11) are labelled in the changed documents.