Add pinned plugin security scan

[hjqcan]

Summary

• add the HOL plugin scanner as a read-only GitHub-hosted check
• pin checkout and scanner actions to immutable commits
• keep online probing, submissions, SARIF uploads, and repository secrets disabled
• add a release contract test for the workflow security boundary

Verification

• bun test tests/release/orchestration-protocol-boundaries.test.ts (9 pass)
• bun run typecheck
• bun test (6802 pass, 60 skip, 0 fail)
• git diff --check

This is the prerequisite scanner evidence requested by hashgraph-online/awesome-ai-plugins before submitting the GoodMemory Kimi plugin listing.

[hjqcan]

Blocked on native Kimi scanner support; keeping this draft instead of merging a permanently red workflow into main.

Evidence from the pinned action run: scanner 2.0.1116 reports ecosystems: ["codex"], requires .codex-plugin/plugin.json despite the repository shipping kimi.plugin.json, and produces 138 high findings by scanning the application/research tree. Reproduction: https://github.com/hjqcan/GoodMemory/actions/runs/31986119511

Upstream issue: hashgraph-online/hol-guard#2446
Listing PR: hashgraph-online/awesome-ai-plugins#95

We should not merge until HOL can validate the actual Kimi bundle without a fake Codex manifest, duplicated manifest, lowered severity threshold, or broad suppressions. Once fixed, update to the reviewed immutable action SHA and rerun the same gate.

[hjqcan]

Validation evidence before merge: the native Kimi scan completed with HOL AI Plugin Scanner 2.2.118 against kimi.plugin.json for GoodMemory 0.7.5. Result: 93/A, policy pass, 0 critical and 0 high findings; ecosystems reported kimi. The full repository CI and Node package boundary checks for Node 20/22/24 also passed. This is maintainer-controlled integration evidence, not independent user adoption evidence.