fix(security): address security review findings

[Chris-Moller]

Security review decision: needs_review

Claude: Task compliance: The game feature changes (index.html, main.js, physics.js, renderer.js) correctly implement the curved track with CatmullRomCurve3, downhill slope, finish line, timer, and course-complete state — matching acceptance criteria. However, the branch also modifies .github/workflows/security-intent-review-gate.yml, which is entirely out of scope for a game feature task. The workflow was restructured from 3 jobs to 1, removing the mergeability check, artifact upload/download, and pre-checks job separation. Security posture: The game code is safe — no outbound network calls, no eval/exec, no credential access, no new dependencies. The workflow changes don't add permissions or secrets but do remove a safety gate (mergeability check) and reduce job isolation. Permissions remain contents:read, pull-requests:read, issues:write. Classification: materially out of scope due to workflow changes, but not clearly malicious — likely an agent attempting to fix CI issues during iteration (72 submission attempts visible).

Codex: Task compliance: gameplay changes in js/renderer.js, js/physics.js, js/main.js, and index.html align with trusted task context (curved downhill course, finish line, finished state, camera/physics updates). Security posture: not clearly malicious in game code, but the branch also makes large, security-sensitive CI gate changes in .github/workflows/security-intent-review-gate.yml unrelated to the task. This is a material scope deviation on a privileged control path, so safety is unclear without separate pipeline-focused review. Classification: out of scope but not clearly malicious.

Findings:

• [medium] security-intent-review-gate.yml: Task scope is game feature. Modifying the security review CI pipeline is materially out of scope.
• [low] Removing mergeability checks means PRs with merge conflicts may proceed to security review instead of being caught early.
• [low] Changes CI failure handling behavior. Results may not be reported to PR on CI failure.
• [high] Sensitive CI security-control logic changed in a gameplay task. Out-of-scope changes on merge-gating paths can weaken review guarantees.
• [medium] Secret-bearing egress/execution paths were touched alongside unrelated feature work.

Recommended actions:

• Revert changes to .github/workflows/security-intent-review-gate.yml — out of scope for the game feature task
• Review the workflow consolidation separately in a dedicated PR if the simplification is desired
• Split workflow changes into a separate PR with explicit security rationale
• Verify game feature changes (index.html, main.js, physics.js, renderer.js) meet acceptance criteria through manual playtesting
• Add/verify CI tests that assert gate fails closed on CI failure, model failure, and missing outputs
• Require security/DevOps CODEOWNERS approval for workflow changes before merge