[umbrella] Harden CI: 5 rubber-stamp vectors found in PR #155 audit

[BillyOutlast]

Problem

PR #155 (and the reopened #156) showed that the Drop monorepo's CI is rubber-stamping. The adversarial audit identified 5 hardened findings. This issue tracks the umbrella remediation — child sub-issues split the work.

Root Causes (Confirmed)

#	Finding	Severity	Evidence
F1	develop branch has zero protection rules	CRITICAL	gh api repos/BillyOutlast/drop/branches/develop/protection → HTTP 404
F2	All 15 workflows filter pull_request.branches: [rebuild] only	HIGH	Verified ci.yml, server-ci.yml, cli-ci.yml, desktop-ci.yml, droplet-ci.yml, e2e.yml, codeql.yml, osv-scanner.yml, editorconfig-ci.yml, open-code-review.yml — zero list develop
F3	Four continue-on-error: true mask security/quality failures	HIGH	ci.yml:97 pnpm audit, ci.yml:220 SonarCloud, osv-scanner.yml:31, .github/actions/rust-ci/action.yml:129 cargo audit
F4	Codecov is purely informational	HIGH	fail_ci_if_error: false ×3 (ci.yml:174, server-ci.yml:125, rust-ci/action.yml:122). Baseline 29.32%, no codecov.yml exists
F5	Per-workspace path filters skip root-config commits	MEDIUM	cli-ci.yml, desktop-ci.yml, droplet-ci.yml lack pnpm-workspace.yaml in paths:

Sub-issues (Wave Order)

1. PR-A / Phase 1: Branch protection on rebuild + develop (CRITICAL) — HIGH risk, must land first
2. PR-A / Phase 2: Add develop to pull_request.branches in all workflows
3. PR-B / Phase 3: Continue-on-error triage (SonarCloud unmask, pnpm/cargo new-vuln detection, OSV doc)
4. PR-B / Phase 4: Add .github/codecov.yml with informational thresholds
5. PR-C / Phase 5: Per-workspace root-config paths

Verification

End-to-end synthetic PR tests (A-E) per the adversarial plan bundle:

• A: PR to develop fires all required workflows
• B: Coverage drop shows red patch comment, non-blocking
• C: SonarCloud quality gate failure blocks merge
• D: Root-config-only commit triggers per-workspace CIs
• E: New critical vuln fails workflow

Provenance

Adversarial 4-member hyperplan (skeptic / workflow-archaeologist / log-forensics / remediation-architect), 3 rounds: independent analysis → cross-attack → defend/refine/concede. Cross-attack verdicts: 5 hardened findings, 7 overturned, 3 downgraded. Plan agent sequenced with 3 execution waves.

Target total effort: ~5.5 hours across 3 stacked PRs.