feat(security): converge portfolio admission semantics

[saagpatel]

Summary

• add deterministic SecurityAdmissionV1 over fresh coverage, Dependabot, CodeQL, and secret-scanning evidence
• make strict gating, risk/attention, PortfolioTruth rollups and rendering, decision queue, weekly command center, and demo digest consume the same fail-closed result
• keep known provider findings visible under partial or contradictory evidence while withholding a clear/actionable admission
• retain PortfolioTruth 0.11.0 and legacy compatibility fields, with additive reason/count fields
• refresh the PCC and reusable portable consumer fixtures and their bound digests

Kill test

The live strict gate already combined all three providers, but risk, decision, weekly, and Markdown surfaces still used Dependabot-only semantics. A CodeQL High or open secret could therefore block one surface and disappear from another. The gap survived.

Security properties

• missing, partial, stale, malformed, conflicting, or clock-inconsistent evidence never renders clear
• explicit stable SECURITY_* reason codes identify the failed admission predicate
• a known positive provider count remains visible even if a compatibility field conflicts
• complete clear requires all three observed providers, closed pagination, valid clocks/counts, a fresh receipt, and matching compatibility counts
• no reachability claim or portfolio attention-policy change is introduced

Verification

Exact head: 0671717b (full SHA available in PR metadata)

• pytest -q: 3484 passed, 2 skipped
• focused TAR-02/contract matrix: 426 passed
• ruff check src tests: passed
• mypy src/security_admission.py --ignore-missing-imports: passed
• deterministic producer/portable contract generator --check: passed
• git diff --check: passed
• live PortfolioTruth replay: cohort 11; admission fail 3 / pass 2 / unknown 6; admitted 5 / unadmitted 6; 3 actionable security decisions; 5 blocking High findings; gate, weekly, registry, and report surfaces agree

Claim ceiling

This proves exact-revision source, deterministic fixture, local test, and live-snapshot replay readiness. CI/review, protected-branch merge, downstream consumer repins, installed-runtime uptake, and natural scheduler evidence remain separate until read back.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.