ci(gates): Make API security, build, and artifact checks non-skippable (#395) - #443

Summary

Resolves #395 (V2-BE-044).

Scope of Changes

• Enforced mandatory, non-skippable API gates across TypeCheck (\ sc --noEmit), Lint, Unit/Integration Tests with Coverage (\ est:cov), Container Vulnerability Scan (\ rivy), and Build Drift Detection.
• Removed unconditional skips and permissive \continue-on-error\ flags.
• Pinned actions to secure versions and configured least-privilege permissions (\permissions: contents: read, \security-events: write).
• Added sensitive changes protection gate requiring human maintainer approval for auth, indexer, database, and workflow modifications.
• Documented local reproduction commands in \docs/local-reproduction.md.

Acceptance Criteria

• Each required job is reproducible locally or in a documented container.
• Deliberate failures in every gate block validation.
• No required result is neutralized by \continue-on-error.
• Fork workflow authorization is documented correctly.
• Changed head SHA requires fresh approval for sensitive work.