Harden package and history privacy gates

[alicankiraz1]

Summary

• route exporter, ZIP, extracted-root, and validation secret checks through one byte-safe scanner
• fail closed for invalid known-text encoding and scan opaque payloads across bounded windows, including UTF-16 and UTF-32 projections
• scan the complete public Git graph under fixed object, byte, and time budgets without disclosing matched content
• add a hash-only temporary history baseline that blocks check-release until the approved rewrite
• pin GitHub Actions to full SHAs, fetch full history, add Dependabot, and provide the stable required / CodexQB aggregate check

Security closure

• CQB-PKG-001: fixed with original PoC plus expanded binary/encoding/package regressions
• CQB-HIST-001: bounded and regression-protected; final closure remains intentionally gated on the approved history rewrite
• no raw secret value or secret-bearing line is emitted in diagnostics, JSON, or receipts

Local validation

• make check-fast — 167 passed
• make check-unit — 178 passed
• make check-platform — 26 passed; Darwin capability ready
• make check-schema — 11 passed
• make check-behavior — 227 passed; 20 fixtures passed
• make check-package — 219 passed, 1 expected skip
• make check-public-privacy — 16 current files, 64 commits, 725 blobs, 70/70 baseline matches
• make check-release — expected fail at history_privacy_baseline_must_be_empty

Independent security re-review found no remaining actionable P1/P2 on b9fda42eabc0bf35556391bdcc16cccae173c856.