feat: run the canonical gate and practice the security it teaches

[fmind]

What

Brings the course repository's own tooling up to the stack it teaches, ahead of the chapter rewrites.

Why

• Chapter 4.4 teaches pip-audit, gitleaks and Trivy. The repository ran only gitleaks.
• CI listed its steps itself rather than calling one named gate, which is the drift this course argues against.
• pages.yml declared contents: read at workflow level and only pages/id-token at job level. A job-level permissions: block replaces the workflow-level one, so the deploy job was running with contents: none.
• assign.yml was two majors behind, and its pull_request: [opened] trigger gets a read-only token on fork PRs regardless of the permissions: block — so it was guaranteed to put a red X on exactly the external contributions the README invites.

How

• all task (format → check → build), run as the single CI step with test -z "$(git status --porcelain)". No test task was invented: this repository is prose, and mkdocs build --strict is its only executable assertion — check:build already runs it.
• check:actions (actionlint + zizmor), check:vuln (pip-audit), check:scan (trivy, with a committed trivy.yaml); check:format extended with validate-pyproject and uv lock --check.
• Weekly full-history security.yml; grouped Dependabot with the chore(deps) prefix.
• python = "3.14" pinned in [tools] and mise.lock committed, so CI provisions the interpreter the course tells readers to pin.
• pages.yml spells out all three permission scopes; assign.yml bumped to v4 and scoped to issues (rather than hiding a certain failure behind continue-on-error).
• lefthook priorities 10/20/30, with the hook name mirroring a real format:dprint task.
• PEP 639 license form; .mypy_cache ignore dropped from a repository with no Python sources.

Test plan

• mise run all — exit 0; mkdocs build --strict green (and green before the change, so no pre-existing docs breakage was masked).
• zizmor --offline .github/workflows/ — "No findings to report" across all four workflows.
• trivy --config trivy.yaml fs . — 0 findings across all four scanners.
• lefthook validate — "All good"; gate run twice with identical exit code and porcelain output.
• Verified pozil/auto-assign-issue v3 (CommonJS→ESM) and v4 (Node 24) renamed no inputs before bumping.

Not in this PR

Chapter content. docs/** is untouched here so the prose rewrite lands as its own reviewable change.