Runs the PR CodeQL security guard as high-confidence high/critical security coverage and adds the initial plugin/package-contract quality guard.
Adds the plugin trust-boundary CodeQL security shard on Blacksmith and documents the rollout scope.