S440 — sample-theme codeload lock + gate parity (finish-S246)

[detain]

S440 — sample-theme codeload lock + gate parity (finish-S246)

sample-theme was the last of the 11 plugin repositories with no dependency-drift gate at all: no committed lock, no gate script, no CI leg. The S246 sweep recorded it as gated using TRAKT's statistics (a wrong-directory measurement) — the repo itself was never checked on disk until S440.

This PR brings it to parity with the ten gated siblings (trakt/omdb/anilist/anidb/hub/…), mirroring the trakt/omdb exemplar structure:

• composer.lock — committed lock of its actual codeload/GitHub-zipball deps (derived at tip 1ea573b): 5 require + 28 require-dev = 33 packages.
• scripts/security-audit-check.php — the whole-lock audit gate (composer audit --locked, no --no-dev), corpus floored at 28 total / 24 dev.
• .github/workflows/test.yml — a composer-audit job (name Security Audit) kept LAST, no continue-on-error, no if:, runs on pull_request.
• tests/SecurityAuditCheckTest.php — the guard test that fails on each neutering edit.

Acceptance (planted-drift RED → GREEN)

Against a /tmp copy of the real committed lock, drifting squizlabs/php_codesniffer to the affected 4.0.1 and planting CVE-2026-67434:

::error::Security audit FAILED — 1 advisory/ies affecting 1 package(s) (0 require, 1 require-dev).
  squizlabs/php_codesniffer [require-dev] locked at 4.0.1 (affected: <3.13.6|>=4.0.0,<4.0.2)
    [HIGH] CVE-2026-67434 — OS command injection in the diff/report writer

Restoring the version / clearing advisories → Security audit passed. (exit 0). Local suite: phpunit 42/42, phpstan level 9 clean, phpcs clean.

Notes

• .gitignore still lists /composer.lock (matching every gated sibling) — the lock is force-added and tracked, exactly as trakt/omdb do.
• No *.md added to the repo (P-1).

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.