Baseline supply-chain & secret hygiene: gitleaks, pip-audit/npm audit/cargo-audit, dependabot

[aaronsb]

ADR-401 item 7 · Audit: docs/security/security-consistency-audit-2026-06-09.md (F7)

None of the standard off-the-shelf hygiene runs anywhere: no secret scanning, no dependency auditing, no dependabot config. This is wiring, not authoring — the project has strong domain-specific linters but zero baseline tooling.

Acceptance criteria

• gitleaks (or equivalent) workflow on PRs + a one-time full-history scan
• pip-audit (api), npm audit (cli, web), cargo audit (graph-accel) in CI — informational at first, blocking for high/critical after the initial triage
• .github/dependabot.yml covering pip, npm, cargo, and github-actions ecosystems
• Initial findings triaged (separate follow-ups if anything real surfaces)