[Audit Follow-up] Add CI security checks and regression tests for ChainLens

[brucey0017-cloud]

Background

High-priority code audit completed with direct fixes for command injection/input validation/error handling.

Remaining hardening items

1. Add CI workflow (ruff + mypy + py_compile + bandit). ✅
2. Add unit tests for:
   • input validation (address/chain)
   • risk-score edge cases (missing/partial API payloads)
   • report filename sanitization
3. Add structured JSON schema validation for OnchainOS responses to prevent silent data-shape drift.
4. Add minimal redaction helper for future logs/reports (in case upstream includes sensitive fields).

Why this matters

Current runtime behavior is safer, but CI/test guardrails are needed to keep safety and reliability stable as the project evolves.

Updated 2026-03-19: CI workflow confirmed operational.