Expand CI coverage and remediate dependency and supply-chain risks

[SuperstrongBE]

Summary\n\nEstablish reproducible quality and security gates for every package, then remediate or explicitly track vulnerable and stale dependencies.\n\n## Scope\n\n- Run formatting, linting, type checking, unit tests, integration tests, and production builds in CI.\n- Add focused coverage for the daemon trust boundary, policy compiler, onboarding flow, keystore, RPC validation, and sign versus broadcast separation.\n- Test supported runtime versions and operating systems where behavior differs.\n- Run dependency vulnerability review in CI with a documented severity policy.\n- Track transitive advisories such as #8 until the upstream dependency path is removed or patched.\n- Pin reproducible installs with the lockfile and fail on unexpected lockfile drift.\n- Review lifecycle scripts, dependency provenance, release artifacts, and secret exposure.\n- Add automated secret scanning and generated-artifact checks.\n- Define required branch protection checks and prevent publishing when a required gate fails.\n- Produce coverage and test artifacts that make regressions diagnosable.\n\n## Acceptance criteria\n\n- A clean checkout can install, test, and build reproducibly in CI.\n- Pull requests cannot merge when required lint, type, test, build, or security gates fail.\n- Dependency findings have an owner, severity, remediation decision, and expiry date for any exception.\n- Security-critical modules have meaningful branch and negative-path coverage.\n- CI tests verify that private keys, tokens, fixtures, and sensitive logs are not included in release artifacts.\n- Release documentation identifies the exact commit, lockfile, runtime, and workflow used to produce an artifact.

[SuperstrongBE]

Delivered in #48 (CI security gates: dependency audit, gitleaks secret scan, release-artifact check) and hardened since across the security wave. Merged to main.