Audit and harden supply-chain controls on repo and release pipeline

[noelmcloughlin]

Before any `1.0.01 release - consider hardening repo and release pipeline as supply chain attacks are concern and blast radius/reputation can impact adopter confidence. AI Agent ingestion is a general governance concern and OKF bundles are exactly designed for this.

See linkml/linkml#3623