Security hardening

[jeremydixon22]

Summary

• require a configured API key before the server container starts and verify anonymous MCP is rejected
• commit and enforce NuGet dependency locks; add a hash-verified Python REST/MCP host deployment profile
• keep CodeQL, dependency review, container security, release integrity, and execution-consumer assurance workflows continuously active

Verification

• dotnet restore Vyral.sln --locked-mode
• Python hash-verified server-profile installation
• policy, workflow-health, version, and public-export rehearsals
• server startup/authentication checks (full strict Docker harness deferred to hosted runner: this local Docker host rejects the chiseled image under its existing no-new-privileges/read-only setup before process execution)