Security screening: testing quality program

Classification: routine repository CI/testing work with supply-chain-sensitive tooling changes.

Required controls:

never expose or enumerate secrets in test logs or retained artifacts;
pin third-party Actions and Python tooling through project-owned configuration;
review every new CI action/dependency before execution;
keep pull-request tests offline and credential-free;
make remote/provider tests opt-in and least-privileged;
generate vulnerability, secret, license, and SBOM evidence without uploading source, checkpoints, prompts, model outputs, or credentials to third parties;
treat tracker text as untrusted input under the configured AIWG high-assurance threat-assessment policy.

Screening result: proceed in dependency-ordered PRs with CI green and exact-head review before each merge.