Security hardening: close supply-chain and policy gaps

[ms-kumar]

Gap analysis (deep scan 2026-09-25)

Checked: Dependabot alerts, pip-audit on project env, secret scan (tree + full history), dangerous code patterns (eval/exec/pickle.loads/yaml.load/subprocess), Actions pinning, workflow permissions, Dependabot config, branch protection, secret scanning/push protection, CodeQL status.

Already secure (verified, no change):

• Deps: pip-audit clean; alerts chore(deps): bump the uv group across 1 directory with 2 updates #1 (torch), Add Bandit security linter workflow #2 (setuptools CVE-2026-59890), Create SECURITY.md for security policy #3 (black) all fixed
• No secrets in tree or history; no dangerous code patterns in torml/
• Workflows already least-privilege (contents: read); secret scanning + push protection enabled; CodeQL green

Gaps fixed in this PR (one commit each):

1. Actions on mutable tags (@v4/@v5, supply-chain risk) → pinned to SHAs
2. No dependabot.yml (updates were ad-hoc) → weekly schedule, grouped uv updates
3. No SECURITY.md → reporting policy + supported versions

Deliberately not changed (needs your call):

• Branch protection on main is off — recommend requiring PR + CI/Test checks (command in comments)
• release.yml has no provenance attestation — follow-up once publishing to PyPI