Summary

• Add a dedicated Security Audit workflow for dependency and static-analysis checks.
• Run pip-audit on pushes, pull requests, a weekly schedule, and manual dispatch.
• Run Bandit for high-severity findings, with B602 temporarily skipped while [Security hardening] Require explicit opt-in for workflow shell steps #2440 tightens shell-step permissions.

Security context

This creates a repeatable baseline so dependency advisories and high-severity static-analysis issues are caught in CI.

Closes #2438

Validation

• git diff --check
• uvx pip-audit . --progress-spinner off
• uvx bandit -r src -lll --skip B602
• rg -n "uses: [^@]+@v[0-9]" .github/workflows/security.yml