ci: add malware guard for hidden-payload worm signatures

.github/workflows/malware-guard.yml

@@ -0,0 +1,33 @@
+# Blocks the obfuscated-payload worm seen in Drips Wave repos (Sep-Oct 2026):
+# code hidden after long runs of whitespace in config files, plus
+# branch_structure.json / temp_*_push.bat entries added to .gitignore.
+name: Malware guard
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Scan for known payload signatures
+        run: |
+          set -u
+          fail=0
+          check() {
+            hits=$(git grep -nIP "$1" -- "${@:2}" ':!.github/workflows/malware-guard.yml' ':!*lock*' ':!*.min.js' | cut -c1-200)
+            if [ -n "$hits" ]; then echo "::error::$1"; echo "$hits"; fail=1; fi
+          }
+          check '\S[ \t]{150,}\S|^[ \t]{150,}\S' '*.js' '*.cjs' '*.mjs' '*.ts' '*.jsx' '*.tsx'
+          check "global\.i\s*=\s*'|global\[['\"]!['\"]\]" '*.js' '*.cjs' '*.mjs' '*.ts' '*.jsx' '*.tsx'
+          check 'temp_auto_push|temp_interactive_push|branch_structure\.json' '.gitignore' '**/.gitignore'
+          check '"runOn"\s*:\s*"folderOpen"' '.vscode/*'
+          exit $fail