chore(bestpractices): rewrite to canonical autofill schema (RAN-57) (… #18

Job	Run time
Gitleaks (secret scan)	12s
Trivy (filesystem + container scan)	36s
OSV-Scanner (SCA)	7s
jscpd (duplication < 3% on touched code)	13s
Semgrep (SAST)	27s
SBOM (SPDX + CycloneDX)	10s
	1m 45s

Provide feedback