[codex] Add GitHub DevSecOps workflows

[ganesh47]

What changed

This PR adds a GitHub-based DevSecOps baseline for cstack.

• adds Dependabot updates for npm and GitHub Actions
• adds PR security gates for dependency review, CodeQL, and Gitleaks
• adds a scheduled security-intelligence workflow for npm audit, OSV-Scanner, SBOM generation, and OSSF Scorecard
• hardens release preparation and release publication with required-check waiting, SBOM generation, and provenance attestation
• documents the required checks and repository settings in docs/devsecops.md
• aligns package.json package-manager metadata with the repo's actual npm-based workflow contract

Why

The repo already had CI and release automation, but it did not have durable dependency automation, PR-level security gates, scheduled security evidence, or release supply-chain hardening. This closes that gap without changing the existing core build/test/release intent.

Impact

• PRs can now require validate, dependency-review, CodeQL, and Gitleaks
• release preparation can wait for the full required-check set before tagging
• releases can publish SBOM evidence and provenance attestations alongside existing assets
• security maintenance becomes ongoing rather than ad hoc

Validation

• npx --yes actionlint
• npm run build
• npx vitest run test/deliver.test.ts --reporter=dot

[ganesh47]

Superseded by #39, which has already been merged into main.