ci: add free security baseline (#26)

[PeterGuy326]

Fixes #26

Summary

• add reusable, free GitHub workflow templates for CodeQL, dependency review,
  and OpenSSF Scorecard;
• pin every Action to a full commit SHA and keep workflow permissions narrow;
• add maintainer guidance for public/repository-local data boundaries;
• add a local-only validator and an environment allowlist wrapper for
  deterministic checks.

Security boundary

The local validator does not call a network service, an LLM, or GitHub. It
prints counts rather than matching values. The wrapper passes only a small
environment allowlist to the validator, so local GitHub, cloud, package, and
model credentials are not inherited. The templates do not use
pull_request_target, do not reference secrets., and do not grant model,
deployment, or publishing credentials to repository code.

No local environment files, internal documents, credentials, or scanner output
are included in this pull request.

Validation

• ruby -c scripts/bytefolk-local-boundary-check.rb — PASS
• bash -n scripts/bytefolk-scrub-env.sh — PASS
• ruby scripts/validate-governance.rb — PASS
• ruby scripts/validate-brand-assets.rb — PASS
• PyYAML parse of both workflow templates — PASS
• policy check for immutable Action SHAs and unsafe triggers — PASS
• scrubbed local boundary check — PASS
• git diff --cached --check — PASS

Known limits

• This PR does not change repository settings or activate workflows in the
  six existing repositories; adoption remains a reviewed, workflow-only PR
  per repository.
• GitHub-hosted workflow results still need to be observed after adoption;
  local validation cannot prove a remote run is green.
• The local check is conservative and is not a replacement for GitHub Secret
  Scanning and Push Protection.
• Strix and other AI/dynamic scanners remain outside the blocking baseline.