fix: Harden CLI distribution and Unity IPC security

.github/workflows/build-and-test.yml

@@ -40,6 +40,7 @@ jobs:
           scripts/test-is-release-please-release-commit.sh
           scripts/test-release-please-config.sh
           scripts/test-protocol-minimum-version-workflow.sh
+          scripts/test-security-scan-workflow.sh
           scripts/test-verify-native-cli-release-assets.sh
           scripts/test-verify-dispatcher-release-assets.sh
           scripts/test-mark-release-pr-tagged.sh
@@ -50,6 +51,7 @@ jobs:
           scripts/test-dispatcher-publish-workflow.sh
           scripts/test-distribute-attestation-bundles.sh
           scripts/test-install-release-filter.sh
+          scripts/test-bootstrap-manifest-from-bundle.sh
 
       - name: Check IPC protocol reminder
         if: github.event_name == 'pull_request'
@@ -68,6 +70,25 @@ jobs:
         working-directory: cli/release-automation
         run: go run ./cmd/check-dispatcher-minimum-version
 
+      - name: Check dispatcher pin
+        if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch'
+        working-directory: cli/release-automation
+        run: go run ./cmd/check-dispatcher-pin
+
+      - name: Verify published dispatcher pin subjects
+        if: github.event_name == 'pull_request'
+        working-directory: cli/release-automation
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: go run ./cmd/check-dispatcher-pin --base "origin/${{ github.base_ref }}" --head HEAD
+
+      - name: Verify published dispatcher pin subjects without a pull request diff
+        if: github.event_name != 'pull_request'
+        working-directory: cli/release-automation
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: go run ./cmd/check-dispatcher-pin --network
+
       - name: Check release triggers
         if: github.event_name == 'pull_request'
         working-directory: cli/release-automation