security: WS49/WS50 supply-chain hardening + docs refresh

[brokenbot]

Summary

Ports the Criteria monorepo's supply-chain hardening (WS49 osv-scanner gate, WS50 dependency-freshness policy) to this adapter repo, and brings the README up to the documentation standard requested by the security architecture team (setup config, step inputs, config overrides, outputs).

This is config/CI/docs only — no product code changes.

WS49 — vulnerability gate

• osv-scanner.toml (documented + dated ignore convention; currently no ignores)
• make vuln-scan (osv-scanner v2.3.8, pinned)
• CI osv-scan job landed report-only: the initial scan flags stdlib 1.26.3 (GO-2026-5037 / GO-2026-5039, fixed in 1.26.4). This is handed to the follow-up WS51 catch-up PR, which bumps the go directive to 1.26.4 and flips this gate to blocking (drops continue-on-error, adds osv-scan to all-checks).

WS50 — dependency freshness

• docs/dependency-policy.md — latest major.minor + 7-day cooldown + security-bypass
• .github/dependabot.yml — gomod + github-actions, 7-day cooldown, no major-ignore, grouped minor/patch
• make deps-outdated / make deps-majors (pinned go-mod-outdated, gomajor)
• non-blocking CI deps-report job (posts drift to the job summary)

Docs & hygiene

• README restructured: Install · Setup (config) · Step inputs · Config overrides · Outputs · Security
• SECURITY.md (private reporting + supply-chain controls)
• all-checks aggregate gate

Notes

• Multi-arch publishing (linux/{amd64,arm64}, darwin/{amd64,arm64}) was already in place via publish.yml; verified, no change needed.
• WS51 (catch-up upgrades) follows as a separate PR per the agreed sequencing.

Test plan

• make build / make test green locally
• make vuln-scan reproduces the single stdlib finding (report-only)
• CI run on the branch (osv-scan report-only, deps-report non-blocking)

shell-specific

• Removes an 18 MB built binary (criteria-adapter-shell) accidentally committed to the repo; added to .gitignore.