Runs the PR CodeQL security guard as high-confidence high/critical security coverage and adds the initial plugin/package-contract quality guard.
Add a narrow channel-runtime CodeQL critical-security shard and document it.