ci: harden runners and DRY workflow conditions

[idvoretskyi]

Summary

• Add step-security/harden-runner (audit mode, SHA-pinned) as the first step of every job to monitor/log outbound network calls for supply-chain visibility.
• DRY the fork-PR SARIF-upload condition (previously duplicated 3x across gitleaks/Trivy-image/Trivy-fs upload steps) into a single workflow-level env.UPLOAD_SARIF expression, referenced by each upload step.
• Consolidate the devcontainer smoke-test step: the existence-check loop now also prints each tool's version, removing 8 duplicate lines that repeated the same command list.
• Documents the Claude Code CLI install pitfall (EACCES from re-installing over the root-owned feature package, see PR Fix devcontainer smoke test failure from incomplete Claude CLI install #51) and the CI action_required approval quirk for bot-authored branches in AGENTS.md.

Security

• No existing vulnerabilities found beyond the added hardening: SHA pins, persist-credentials: false, minimal permissions, and Trivy/gitleaks gating were already in place.
• harden-runner in audit mode (non-blocking) adds runtime network egress visibility for every job without changing behavior.

Validation

• python3 -c "import yaml; yaml.safe_load(open('.github/workflows/ci.yml'))" — YAML parses cleanly.
• No functional change to job logic/order — refactor only.