chore: supply-chain hardening — lockfile enforcement + action SHA pins

[oz-sayari]

Supply Chain Hardening

Automated supply-chain security controls applied by supply-chain-pr.py.

Changes made

• ci.yml: SHA-pinned 2 actions to full commit hash

Python ecosystem changes

• renovate.json: Added minimumReleaseAge: "7 days" for all PyPI package managers (pip_requirements, poetry, uv, pipenv) — Renovate will not merge a PyPI update until the release is 7 days old
• ci.yml: poetry install → poetry install --no-update (3×)

poetry install --no-update prevents implicit dependency updates during CI installs. The renovate.json cooldown ensures new PyPI releases are not picked up until 7 days after publish.

Why these controls

Control	Threat mitigated
Action SHA pins	Prevents tag-hijack (ref: aquasecurity/trivy-action, Mar 2026)
UV_EXCLUDE_NEWER / renovate.json cooldown	7-day PyPI cooldown prevents same-day version compromise
uv sync --frozen / poetry install --no-update	CI installs exact lockfile versions — no silent drift

Testing checklist

• CI passes on this branch (green)
• Python install/sync step succeeds with no version changes

---

Generated by supply-chain-pr.py — part of the dependency-security-policy rollout.