feat(supply-chain): production-readiness PR 3 — bundle integrity + se… #77

Job	Run time
Semgrep (SAST)	36s
Trivy (filesystem + container scan)	28s
Gitleaks (secret scan)	12s
OSV-Scanner (SCA)	5s
SBOM (SPDX + CycloneDX)	8s
jscpd (duplication < 3% on touched code)	18s
	1m 47s

Provide feedback