ci: add reproducible supply-chain gates

WORKSPACE.md

@@ -42,7 +42,7 @@ accelerator, or remote-execution credentials.
 
 Canonical required checks:
 
-- `python -m ruff check --select F obliteratus tests scripts/check_coverage_thresholds.py scripts/gemma4_12b_recursive_loop.py`
+- `python -m ruff check --select F app.py obliteratus tests scripts/check_coverage_thresholds.py scripts/check_supply_chain_policy.py scripts/gemma4_12b_recursive_loop.py`
 - `python -m pytest` (includes the measured 49% coverage floor)
 - CI additionally enforces the measured 36% branch-coverage floor from its
   retained coverage JSON report.
@@ -55,6 +55,13 @@ in an independent environment outside the checkout, exercises both CLI entry
 paths, and retains the distributions plus evidence. Immutable CI action/tool
 pins are recorded in [ci/digests.txt](ci/digests.txt).
 
+Python CI resolution is locked by `uv.lock`, including the official CPU-only
+PyTorch source for Linux and Windows. The required Supply chain job scans all
+supported Python versions for known vulnerabilities, scans the checkout for
+secrets with fully redacted evidence, enforces the packaged-dependency license
+allow list, and binds a CycloneDX SBOM to the built wheel. Exception and update
+rules are documented in [docs/SUPPLY_CHAIN_POLICY.md](docs/SUPPLY_CHAIN_POLICY.md).
+
 GPU, MPS, model-download, network, and remote-execution checks are conditional
 release or risk-surface gates, not part of the default CPU job.