Runs the PR CodeQL security guard as high-confidence high/critical security coverage and adds the initial plugin/package-contract quality guard.
Adds a narrow critical-security CodeQL shard for the network/SSRF boundary and documents the new category.