Harden security lane with channels and recovery smoke checks

[jsugg]

Summary

• add two semantic security-workflow checks: verify-channels-contract and run-recovery-smoke
• extend CI helper and CLI surfaces to execute and report those checks without inline shell blobs
• add unit and repo-contract coverage for the new workflow/script behavior
• document the new executable evidence in CI/security docs

Notes

• this change keeps the security workflow thin by routing logic through tests/scripts/security_workflow.py
• no product runtime feature behavior was changed; this is CI enforcement and evidence hardening

[jsugg]

Closing this PR as superseded by #163. The hardening changes from this branch are already on main (merge commit ef02e14), and this branch was rebased to main to clear stale conflicts and failed historical checks.