[Quality frontier] Close warranted testing and CI/CD gaps

[edithatogo]

Refined evidence

• Kind/code/tests/workflows: software / 6 / 4 / 1
• Warranted gaps: Property-based, MT, Contract
• CI gaps: concurrency, pinned_actions, dependabot, codeql, dependency_review, workflow_lint, secret_scan

Done when

• Confirm applicability and document exclusions.
• Add warranted deterministic, replayable suites with bounded runtime and thresholds.
• Add least-privilege, concurrency, immutable actions, updates, linting, and applicable gates.
• Keep PR checks fast; schedule expensive lanes and retain evidence.