feat(security): harden fleet security controls, visibility-gated

[gtauzin]

What

Security-hardening pass for the template and root repo (OpenSpec change harden-fleet-security), gated on a new repo_visibility answer so private repos get free OSS equivalents instead of paid services.

Controls

• Visibility gating: repo_visibility + include_codecov answers; Codecov, CodeQL, and Scorecard gated (public gets them, private falls back to ruff S + gitleaks).
• SAST floor: ruff S (flake8-bandit) fleet-wide, with test/build-tooling-scoped ignores.
• Least privilege: top-level permissions: contents: read on every workflow (template + root).
• Secret scanning: gitleaks pre-commit hook and a merge-gating CI job wired into the ci-passed roll-up.
• Self-contained publish: dawidd6 removed, build moved to the tag inside publish-release.yml, native same-run artifacts, @release/v1 → @v1.13.0, plus a CycloneDX SBOM release asset.
• Scoped automation: changelog PR opened with a GitHub App token (template + root), replacing the long-lived PAT.
• Governance: SECURITY.md + CODEOWNERS, classified for updates.
• Fail-loud tests: tests/test_security_hardening.py (10 tests) + updated pin/classification/workflow tests. Fast suite: 380 passed.

Merge prerequisites (do NOT merge until these are true)

1. GitHub App + org secrets APP_ID / APP_PRIVATE_KEY created and scoped to this repo + the 7 fleet repos. Until then the changelog workflow's create-github-app-token step will red — expected on this PR.
2. Green CI on everything else (this PR is the first real-CI exercise of the publish restructure, gitleaks job, SBOM, and the version pins).

Deferred / follow-up

• 7.1 signed tags — BLOCKED: the release tag is developer-created (the tag push is the trigger), so CI can't sign a pre-existing tag without a trigger redesign. Left unimplemented rather than shipping a no-op signing step; the spec requirement needs a decision.
• Operational (9.1–9.5) and fan-out (10.1–10.2) happen after merge + release.

Needs real-CI confirmation

Publish restructure end-to-end, gitleaks binary v8.24.3, cyclonedx-py invocation, and the @v1.13.0 / create-github-app-token@v2 / download-artifact@v7 pins are best-effort correct; Renovate will correct any pin that's slightly off.