chore(security): adopt the public-repo security baseline

[scttbnsn]

This repo went public on 2026-08-16 and the org standard (codeswhat-ops standards/security.md, decided same day) says website repos get the full public baseline plus the DAST tier — a deployed site is never a lighter security shape. The security column here is currently empty. What the baseline means for this repo:

• CodeQL from a committed workflow (JS/TS), not GitHub default setup.
• OpenSSF Scorecard on its supported triggers.
• zizmor + actionlint on the workflows, as a CI gate.
• step-security/harden-runner on every job in website.yml, target egress-policy: block with an allowlist (portwing's ci-verify.yml is the copy source).
• SHA-pin every action with version comments (website.yml is currently tag-pinned).
• gitleaks as a dedicated step (drydock's pinned-binary pattern), plus dependency review on PRs.
• A root SECURITY.md per the onboarding checklist (security@codeswhat.com, private reporting).
• DAST tier: a ZAP baseline scan against the deployed site is in scope per the standard; sizing it to a mostly-static marketing site is your call in-repo.

Mechanics and exact checklist order: CodesWhat/.github REPOSITORY_ONBOARDING.md (just aligned with the registry). Filed from the ops lane per the one-agent-per-repo rule — a resident agent owns this repo, so this is a work order, not incoming code.

[scttbnsn]

Update on the DAST line: the standard now tiers DAST by surface class (security.md, 2026-08-17). Static sites (no auth, no input handling, no server-side handlers) take a ZAP baseline passive scan only, headers/CSP/cookie flags. Active ZAP + Nuclei isn't in scope for this repo unless the site grows a form, login, or API route. So the last bullet is settled, not a sizing call: passive baseline scan, scheduled-advisory.