ci: add static analysis pipeline gate

[batuthzcode]

Summary

• add a dedicated static-analysis GitHub Actions job after the Python test gate
• analyze src and tools with the project CLI and write separate JSON reports
• analyze the controlled sample_app fixture without treating its expected finding exit code as an infrastructure failure
• compare the generated demo report byte-for-byte with the checked-in baseline
• rerun the controlled security-demo integration tests inside the analysis job
• extend the workflow contract tests and CI documentation for Backlog 5.2
• ignore ephemeral local reports/ci output

Why

Backlog 5.2 requires the static analyzer to run as an enforceable pull-request gate. The repository already had a Python 3.11 pytest workflow, but analyzer behavior was only validated locally and the deliberately vulnerable demo could not be invoked directly in CI without handling its expected exit code.

Gate behavior

Project sources

The job generates:

• reports/ci/static-analysis-src.json
• reports/ci/static-analysis-tools.json

Both commands must exit successfully. The current static-analyzer CLI returns exit code 1 for any finding, so this creates a zero-finding policy for the analyzer and dependency-scanner source trees.

This is intentionally stricter than a severity-only gate. The static analyzer uses INFO, WARNING, and ERROR rather than the dependency scanner's HIGH and CRITICAL vocabulary.

Controlled demo

The job also generates:

• reports/ci/static-analysis-sample-app.json

The demo scan must return exit code 1, because the fixture contains five deliberate findings. CI then compares the generated document with reports/sample-app/static-analysis.json and runs tests/test_sample_app_security_demo.py. An unexpected exit code, finding drift, or baseline mismatch fails the job.

Security and operational impact

• the analysis job depends on the complete test job
• both jobs use Python 3.11 on ubuntu-latest
• both official actions remain pinned to immutable 40-character commit SHAs
• checkout credentials remain disabled
• workflow permissions remain contents: read
• the job has a 10-minute timeout and uses no secrets or write permissions
• generated CI reports remain job-local until artifact upload is added in Backlog 5.4

Validation

• GitHub Actions CI run #4: passed
• GitHub Tests (Python 3.11) job on CPython 3.11.15: 988 passed
• GitHub Static analysis job: project and demo gates passed; 4 integration tests passed
• complete local pytest suite: 988 passed
• focused workflow, Python compatibility, and demo suite: 15 passed
• workflow contract suite: 10 passed
• workflow YAML parse and Bash demo-gate syntax checks: passed
• static analyzer against src and tools: 0 findings
• static analyzer against sample_app: exactly 5 expected findings
• checked-in report drift check: passed
• Python compile check, line-length scan, trailing-whitespace scan, and git diff --check: passed

Follow-up

Backlog 5.3 will add a deterministic fixture-backed dependency vulnerability gate. Backlog 5.4 will upload the static-analysis and dependency-scan JSON reports as GitHub Actions artifacts.