feat: sub-project 1 Phase 4-6 — resolver pipeline wiring + 4 Java det… #49

Job	Run time
Gitleaks (secret scan)	11s
Trivy (filesystem + container scan)	34s
SBOM (SPDX + CycloneDX)	9s
jscpd (duplication < 3% on touched code)	16s
Semgrep (SAST)	25s
OSV-Scanner (SCA)	5s
	1m 40s

Provide feedback