ci: enforce bounded no-fix advisory exceptions

[netopsengineer]

Summary

• Add an empty-by-default shared advisory policy with exact GHSA/PyPI package/locked version, rationale, upstream no-fix evidence, and exclusive UTC expiry
• Adjudicate each original uv and OSV report once, preserving numeric exits and raw evidence; fail closed for operational errors, malformed/incomplete data, unrelated findings, available fixes, and stale/expired exceptions
• Keep uv package-status warnings visible with their native behavior and preserve UV_MALWARE_CHECK during sync
• Run PR and weekly dependency audits in independent clean jobs, using an immutable official OSV CLI image maintained by native Dependabot Docker updates
• Prevent the privileged mechanical auto-fix consumer from directly changing policy/scanner/workflow/packaging files or creating untracked files; validate actual PR tree before obtaining its existing write token

No active vulnerability acceptance or branch-protection change is included. Existing required check names remain intact. The auto-fix guard protects direct writes; it does not claim arbitrary generated source content is benign.

Verification

• 664 tests pass; enforced 100% line and branch coverage now includes both policy modules
• Full prek gate passes, including ruff, pydoclint, pyright, bandit, gitleaks, actionlint and zizmor
• Pinned uv 0.11.29 live audit: 20 registry packages, zero findings
• Verified OSV 2.6.0 live scan: 21 packages including project, zero findings
• Synthetic end-to-end tests prove an explicitly accepted no-fix finding passes both scanners, while fixed/unrelated findings and operational failures block; raw JSON is unchanged
• Independent security review passed, including a real recursive OSV extraction-error probe that produced partial JSON and exit 127 and was rejected
• Hosted CI passed at 9aaf5803a5758fc3c145c03d277087b9e33a3258: required gate, deps-security, and pr-title checks all succeeded, including the real read-only/nonroot OSV container invocation
• Successful hosted run and raw scanner evidence
• Sourcery CLI is unavailable locally; no claim of a Sourcery review is made

Merged as 567e3910500d273badb08d864dcba602aec5c285 after the owner explicitly authorized a one-time bypass of the missing approving review. All required checks were green at the exact expected head 9aaf5803a5758fc3c145c03d277087b9e33a3258. The existing review requirement, required checks, and bypass actors remain unchanged.

Post-merge verification: main's tree exactly matches the tested PR tree. Validate, Release, and the new Docker Dependabot update check all passed. The exception policy remains empty.