chore(bestpractices): rewrite to canonical autofill schema (RAN-57) #17

Job	Run time
SBOM (SPDX + CycloneDX)	10s
jscpd (duplication < 3% on touched code)	20s
Gitleaks (secret scan)	11s
Trivy (filesystem + container scan)	33s
OSV-Scanner (SCA)	7s
Semgrep (SAST)	31s
	1m 52s

Provide feedback