ci: harden workflow security and writer safety

[sanskarIN]

Summary

Hardens the Version 2.0.12 maintenance automation without reopening the feature-complete product scope.

Changes

• bound bootstrap-platforms.yml with a finite job timeout and concurrency cancellation;
• serialize bootstrap-branding.yml repository writes with concurrency cancellation;
• add tool/workflow_security_audit.dart to enforce immutable Action revisions, explicit permissions, job timeouts, read-only checkout credential removal, approved writer boundaries, writer concurrency/bot-loop/non-force-push controls, and permanent CI wiring;
• add process-level regression coverage for the workflow-security audit;
• fix the stale workflow security test that assumed four Platform Builds checkouts after the Web/PWA job made the matrix five checkouts;
• run the new workflow-security audit from permanent CI;
• refresh the Version 2.0.12 workflow security policy and maintainer tool documentation.

Release boundary

No product feature scope, package version, release candidate, or manual qualification evidence is changed. The stable release boundary remains fail-closed until genuine real-world qualification is recorded.

Validation

This PR intentionally relies on the repository's permanent CI for canonical Dart formatting, analyzer, full Flutter tests, release/audit gates, solver smoke, and Web build. Platform runner sources/dependencies are unchanged, so the path-filtered native Platform Builds matrix is not expected to be triggered by these workflow-only changes except where its own workflow file is modified (it is not).

[sanskarIN]

CI run #944 reached dependency resolution successfully and failed only at the Dart formatter gate. Dart 3.13.0 reported seven files requiring canonical formatting: test/documentation_completeness_test.dart, test/platform_support_audit_cli_test.dart, test/source_completion_audit_cli_test.dart, test/workflow_security_audit_cli_test.dart, tool/platform_support_audit.dart, tool/source_completion_audit.dart, and tool/workflow_security_audit.dart. Commit 4ec3a008de2b9dbaa7e268448ae9166855364aaa applies the exact formatter-produced blobs from the repository's pinned Flutter 3.47.0 / Dart 3.13.0 environment. Fresh CI and Dependency Review runs are now required; no success is claimed until those exact-head runs complete.

[sanskarIN]

Follow-up validation on corrected head 4ec3a008de2b9dbaa7e268448ae9166855364aaa: CI run #945 passed dependency resolution, metadata synchronization, Dart 3.13 formatting, and static analysis. The full suite then reported 351 passed / 3 failed, all in test/current_release_state_test.dart. The failures were stale evidence-location assertions: an old Phase 32 CI/native run ID was still expected in active what_changed.md, and Phase 30/31 verification filenames were still expected as direct entries in the rebuilt docs index. The historical evidence itself remains preserved in what_changed_archive_phase_32.md, and the Phase 30/31 files remain source-controlled. Commit 05f6fe323d1fcd4c61f78c41426106408587d4f6 updates the regression test to enforce the current active/archive/index boundary instead of obsolete document placement. Fresh CI #946 and Dependency Review #28 were created for this exact head but are still queued on GitHub-hosted runners; no pass is claimed and the PR remains unmerged.