ci: add adversarial security audit workflow

[Conrad Rockenhaus (skyphusion)]

Summary

• Adds advisory LLM red-team audit on every PR (Kimi K2.7 Code, merge-base diff).
• workflow_dispatch supports K3 full-repo deep scan (repo mode).
• CodeQL remains the merge gate; findings post as a PR comment (upsert).

Credentials

Org ADVERSARIAL_AUDIT_CF_API_TOKEN, CF_AIG_TOKEN, FLEET_CHEZMOI_READ_TOKEN, vars CLOUDFLARE_ACCOUNT_ID, AI_GATEWAY_ID.
Org FLEET_CHEZMOI_READ_TOKEN: read-only deploy key on fleet-chezmoi (not RUNNER_GROUP_ADMIN_TOKEN).

Template

fleet-chezmoi system/ci/adversarial-audit-public.yml pinned @ 43be53981a895cd4399babab30cde27823744170

Test plan

• Merge PR; open a test PR and confirm adversarial audit job runs and posts comment.

[github-actions]

Adversarial security audit

Generated 2026-07-22T16:47:27.678Z · 054cde0...f83a14b

Workflow PR conditional and secret verification only address fork trust; pin verification lacks transitive-history checks but no direct authz/injection/SSRF/data-leak exploit in this diff.

Severity	Location	Finding
-	-	No findings