ci: add security and coverage guardrails

[thodson-usgs]

Summary

• measure package-only branch coverage and enforce a reported 90.00% floor
• enable Ruff security rules with line-specific exceptions for trusted pickle round-trips, non-cryptographic retry jitter, and a deliberate fake test token
• add pip-audit==2.10.1 to the weekly/manual advisory Code Health report rather than every pull request
• give the merge workflow read-only permissions, remove persisted checkout credentials, and pin touched official actions to immutable SHAs
• document the complete local feedback loop and add agent guidance against broad security suppressions and reflexive copy-paste

Rationale

This follows up on Lessons from three months of vibe coding. The repository already has most of the feedback loop the article recommends: Ruff, strict mypy, offline tests, pre-commit, cyclomatic and cognitive complexity ratchets, Wily trends, Pyscn duplication/dead-code reports, Import Linter contracts, ADRs, and installed-wheel smoke tests.

This PR adds only distinct gaps. The coverage floor is aggregate and intentionally leaves cross-platform margin below the current 93.75%. Project-path pip-audit checks the latest compatible core resolution; it does not claim to cover every allowed version or optional extra. It runs with the Monday/manual health scan so advisory lookup and dependency resolution do not add about 34 seconds to every PR.

Validation

• pre-commit run --all-files
• coverage run -m pytest tests/ && coverage report -m: 767 passed, 93.75% package branch coverage
• python -m pip_audit --strict --progress-spinner off .: no known vulnerabilities
• python -m pip wheel --no-deps --wheel-dir <temporary-directory> .

Not Added

• Bandit: Ruff S rules provide the same static security-smell category without another scanner.
• Vulture, Pylint duplicate-code, or another repository scanner: the weekly Pyscn report already covers dead code and duplication, including the known false positives in public getter families.
• Another complexity or architecture tool: Xenon, Complexipy, Wily, Pyscn, Import Linter, and architecture tests already cover those feedback channels.
• Mutation testing: potentially useful for selected critical modules, but it needs a scoped operator set and runtime budget before it can become a reliable gate.
• A new task runner: wrapping the existing cross-platform pre-commit and coverage commands would add another configuration surface primarily to shorten three documented commands.

Repository Follow-Ups

These cannot be delivered by this PR:

• Required status checks are not configured on main; the existing merge checks should be required for these gates to block merges.
• GitHub secret scanning and push protection are currently disabled; enabling the repository-native controls is preferable to adding a second in-repository secret scanner.