feat: July 2026 enterprise-grade expansion (language + quality + security + testing packs)

[rldyourmnd]

Summary

The July 2026 enterprise-grade expansion. Grows the reusable library from 23 to
42 workflows and the catalog from 46 to 67 capabilities (38 pinned tools),
holding the existing three-tier model and every convention. Ten atomic commits;
validate_all (9/9), actionlint, and zizmor are green across all 42
workflows after each.

• Language packs (8 new): Dart/Flutter, C/C++, Qt, Kotlin/Android, Swift, R,
  HTML/CSS, SQL — joining Python, Node, Go, Rust, Java, .NET, container, Terraform.
• Quality gates (3): coverage-gate, docs-quality, pr-hygiene.
• Free SAST/SCA/IaC (5): Semgrep, OSV-Scanner, Grype, hadolint, Checkov —
  free on every tier including private-free, where CodeQL and dependency
  review are paid. All gate-only (no security-events).
• Advanced testing (3): mutation-testing, fuzzing, benchmark.
• Level-3 opt-in (2 self-contained examples): AI code review, release-please.

Every new third-party action was SHA-pinned with a version comment, resolved live
via gh, and verified against its action.yml input contract. New docs page
docs/15-language-and-quality-packs.md; examples/ gains
languages/ quality/ security/ testing/ level3/. VERSION → 0.3.0.

Type of change

• New reusable workflow / capability (19 reusable workflows + 2 Level-3 examples)

Threat-model note

New attack surface = the newly pinned third-party actions and a few write scopes.
Containment:

• Every action is pinned to a full commit SHA (version comment) and verified
  against its action.yml; CLIs are checksum-verified (OSV-Scanner) or
  version-pinnable (Semgrep, sqlfluff).
• Top-level permissions: {}; each job requests the minimum. Write scopes are
  isolated to the jobs that need them and documented so callers grant only those.
• New security scanners are gate-only (no security-events: write) — they add
  no code-scanning permission on any tier.
• No ${{ inputs.* }} / ${{ github.event.* }} in run: (env-indirection);
  persist-credentials: false; harden-runner egress audit; no pull_request_target.

Permissions diff

Most jobs are contents: read. Escalations, per job, justified:

pr-hygiene labeler:   + pull-requests: write               # apply labels
pr-hygiene stale:     + issues: write, pull-requests: write # sweep stale items
benchmark:            contents: read -> contents: write     # gh-pages history (auto_push)
coverage-gate:        contents: read (codecov_token secret)
ai-review (example):  + pull-requests: write               # post review comments
release-please (ex):  + contents: write, pull-requests: write # open release PR

Checklist

• All third-party actions pinned to a full 40-char commit SHA with a # vX.Y.Z comment.
• Least-privilege permissions (top-level {}, per-job minimal scopes).
• timeout-minutes on every job; concurrency in the caller examples.
• persist-credentials: false on every actions/checkout.
• No ${{ inputs.* }} / ${{ github.event.* }} inside run: (env-indirection).
• Dual-tier toggles (enable_harden_runner) preserved; new scanners gate-only.
• actionlint passes locally (all 42 workflows).
• zizmor passes locally (all 42 workflows; only auto-suppressed notes).
• README + docs/ + catalog/ updated; each new workflow has a catalog entry + example.
• CHANGELOG.md updated under [0.3.0]; VERSION bumped.
• [~] Commits DCO signed-off (-s) + Conventional Commits. Not GPG/SSH-signed locally (signing unset); required_signatures on main is satisfied by a signed squash-merge.

Tier impact

• Public (free full suite)
• Private free tier — expanded: free SAST/SCA/IaC now covers the private-free gap
• Private paid tier (GHAS)

Verification ceiling

GitHub Actions runtime is not executed in this environment, so new reusable
workflows are held to the repo's existing static bar (validate_all + actionlint +
zizmor + catalog + example) — identical to the pre-existing packs. Runtime proof
happens when a downstream repo (or a sandbox) calls them.