Harden release audit gates and refresh trust docs

[blisspixel]

What changed

• Add one bounded, fail-closed dependency-audit retry runner for recognized transport failures.
• Resolve the installed auditor under Python isolated mode and cover both file and package module collisions.
• Make the later release SBOM audit reject every nonzero status.
• Run CodeQL on every push to main as well as pull requests, weekly scans, and manual runs.
• Refresh roadmap, release, security, supply-chain, assurance, traceability, and OpenSSF guidance for current behavior.

Why

The v2.6.5 release needed a manual job retry after a transient advisory-service connection reset. The first wrapper implementation also exposed checkout-sensitive Python module selection, and the later SBOM job could accept a finding first disclosed after the enforcing audit. The documentation review found lifecycle and trust claims that no longer matched shipped behavior.

Impact

CLI, JSON, MCP, and runtime collection behavior are unchanged. CI and release audits recover once from a narrow set of recognized transport faults while findings, unknown failures, and exhausted retries remain blocking. Exact main commits receive CodeQL analysis automatically.

Validation

• uv run python scripts/check.py: all 22 stages passed; 5,430 tests passed, 22 skipped; 90.90% branch coverage.
• Focused release, workflow, documentation, audit, and posture checks: 93 passed, 1 skipped.
• Fixed-target module-shadowing PoC: installed pip-audit 2.10.1 selected for both controls; marker absent; documented non-reproduction result returned.
• Markdown links: 154 files passed.
• Added-line privacy, attribution, em dash, and pictograph hygiene passed.