ci: add dependency vulnerability pipeline gate

[batuthzcode]

Summary

• add a deterministic, fixture-backed OSV client for offline dependency scanning
• run the production dependency scanner in GitHub Actions without live HTTP requests
• add a dependency-scan job that reports the checked-in FastAPI vulnerability and gates at CRITICAL severity
• compare generated JSON byte-for-byte with the checked-in sample report
• document the CI architecture, threshold policy, failure behavior, and local reproduction steps

Why

The repository already had a production dependency scanner and a controlled vulnerable sample application, but CI did not exercise that path. A live OSV request would make the security gate depend on network availability and mutable upstream data.

This change records the expected OSV query and response in a fixture, injects that fixture through the normal production scanner path, and keeps the pipeline reproducible. Query mismatches, malformed fixtures, and scanner/source failures fail closed with exit code 2.

Behavior

• the known HIGH FastAPI finding is reported but does not fail the default CRITICAL gate
• running the same scan with --fail-on high returns exit code 1
• missing or invalid fixture data returns exit code 2
• the CI path performs no live vulnerability-service requests
• the dependency job runs after the test job and in parallel with static analysis

CI follow-up

The first PR run exposed a Linux import-path difference: invoking a package file directly did not place the repository root on sys.path, causing ModuleNotFoundError: No module named 'tools'.

Security utilities now run as package modules with python -m tools..., use relative package imports, and have a subprocess regression test that removes the repository root from PYTHONPATH.

Validation

• GitHub Actions run #7: all three jobs passed
• GitHub Actions full suite: 997 passed
• GitHub Actions dependency validation: 19 passed
• local full suite: 997 passed
• local focused CI, dependency integration, report, and compatibility suite: 39 passed
• generated sample reports verified current
• workflow YAML parsed successfully with Tests, Static analysis, and Dependency scan jobs
• dependency job shell commands passed Bash syntax validation
• source, tools, and sample-app analyzer expectations passed
• git diff --check passed

Follow-up

Uploading generated security reports as GitHub Actions artifacts remains a separate backlog item.