ci: make full validation fail closed on security checks

[codeforester]

Fixes #310

• require Bandit and pip-audit in the authoritative full validation gate
• exclude only the unpublished editable checkout from the dependency audit
• write a machine-readable full/partial result and reject missing Node.js as non-authoritative
• install Node.js in distribution/WSL validation lanes

Focused checks and shell validation pass locally.