Accelerate and harden evidence gates

[jeremydixon22]

Summary

• classify pull-request changes and skip unaffected language builds and CodeQL analyses while preserving every required check context
• keep full package, consumer, SBOM, container, security, and regression evidence on canonical main, tags, and manual release rehearsals
• restore GitHub-native CodeQL SARIF ingestion while retaining portable analysis artifacts
• contain .NET test residue in an owned temporary root with deterministic cleanup
• add a manual, environment-bound Azure live qualification path with redacted evidence and cleanup enforcement

Unknown, central-contract, workflow, and tooling changes fail open to the complete language suite. Non-pull-request runs are always complete.

Validation

• 328 .NET tests passed; 1 skipped
• 61 JavaScript tests passed with syntax and type checks
• 62 Python client tests and 228 Python runtime tests passed; mypy clean
• Go client tests passed
• actionlint, workflow YAML parsing, all shell syntax, publication policy, and deterministic public export passed
• clean-install wheel and source distribution checks passed

The full release-integrity lane intentionally remains canonical-branch evidence and will run after merge.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.