chore: bootstrap code-signal scanner #1

Job	Run time
SBOM (SPDX + CycloneDX)	14s
Gitleaks (secret scan)	6s
Trivy (filesystem scan)	24s
Semgrep (SAST)	26s
OSV-Scanner (SCA)	6s
jscpd (duplication < 5% on production Go)	13s
	1m 29s

Provide feedback