feat(ci): supply-chain hygiene — secret gate on every PR diff, dependency review, OSV, dependabot, evidence-bar PR template

The repo owned a redaction engine and had zero CI-side secret scanning.
quality-gate.yml now pipes every PR diff's ADDED lines through our own
bin/gstack-redact (gate-secret-scan.mjs, taken from the fork — it dogfoods
the engine): HIGH findings fail the check, MEDIUM prints an advisory count
only (no human in CI to confirm), planted-bug fixtures excluded by pathspec.
Live-verified both directions: PEM key fails, clean diff and MEDIUM shapes
pass; ShellCheck (errors) covers the setup/build shell boundary and passes
today; bun audit gates critical advisories. Trigger is pull_request, never
pull_request_target.

dependency-review.yml adopts the hardened never-merged prior-art branch
(fail-on-severity high, workflow paths watched, tight perms) — verify the
dependency graph parses bun.lock with a canary bump before trusting the
gate. dependabot: weekly, grouped per ecosystem, capped PR counts; and
evals.yml image build/push now skips dependabot actors, whose read-only
GITHUB_TOKEN made every lockfile bump a permanently red check. OSV scans
weekly with a reasoned ignore file. All new workflow actions SHA-pinned.
Scorecard deliberately not taken (no consumer for the score).

The PR template front-loads the evidence bar (live proof, liveness
screenshot, no-ETHOS/voice-changes checklist); the unenforced DCO line is
dropped. bin/gstack-verify-gate ships OPT-IN (never registered by ./setup —
a Stop hook running the project's verify command after every turn is the
user's call), with the fork's tests adapted to pin exactly that.

Ported from time-attack/gstack (GStack 2) + our own prior-art branch.

Co-authored-by: Sina Matian <sina@time-attack.dev>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,44 @@
+<!--
+gstack is AI-coded and proud of it. The bar is EVIDENCE OF REAL USE, not lines
+of code. A PR with no proof behind it gets closed, no matter how clean it looks.
+Fill every section below. See CONTRIBUTING.md → "The evidence bar".
+-->
+
+## Why (in your own words)
+
+<!-- One paragraph: what breaks for a user today, and what this change does about
+it. Not a restatement of the diff. -->
+
+## Live evidence
+
+<!-- REQUIRED. Paste the command(s) you ran and their real output — before and
+after. For a bug: the reproduction, failing then fixed. For a skill change: the
+actual transcript / `claude -p` output. For anything visual: before/after
+screenshots. "bun test passes" alone is not enough — show the behavior you
+changed. -->
+
+```
+# what you ran + what it produced
+```
+
+## Scope
+
+- **Changed:**
+- **Verified live by:**
+- **Did NOT test:**
+
+## Liveness proof (required)
+
+<!-- Attach a screenshot of your own machine with the text `GSTACK PR` typed LIVE
+into a real surface — terminal prompt, a shell command, your browser
+address/search bar, an editor buffer. It must be TYPED INTO A LIVE UI, not drawn,
+overlaid, or edited onto the image. A painted-on `GSTACK PR` is an automatic
+close. This confirms a human opened this PR. -->
+
+## Checklist
+
+- [ ] Liveness screenshot attached: `GSTACK PR` typed live into a real surface (not edited onto the image)
+- [ ] This is not a generated-file-only diff (I edited the source/template and regenerated)
+- [ ] No ETHOS.md edits, and no changes to voice / founder perspective / YC references
+- [ ] New public command / external service / host adapter has an accepted issue linked (or N/A)
+- [ ] Linked issue or reproduction: #