<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
Subsequent PRs will clean up existing failures to enable more checks.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added automated security scanning for repository
workflow/configuration changes and pull requests, with manual trigger
and concurrent-run cancellation.
* **Chores**
* Introduced a configurable audit gate to suppress backlog rules with
guidance for removal.
* Enabled runner hardening, pinned tool versions, read-only checkout,
annotation-enabled reporting, and limited-scope analysis for workflow
files.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Victor Lyuboslavsky
bad1bc5494