Add StepSecurity Harden-Runner egress filtering to CI

[dougborg]

Part of #952.

Harden-Runner instruments the GitHub-hosted runner to monitor (and optionally block) outbound network egress and detect tampering with build tools. A compromised action that exfiltrates secrets or phones home to a C2 shows up immediately.

Task

• Add step-security/harden-runner as the first step of security-sensitive jobs (start with release.yml, release-mcp.yml, security.yml).
• Begin in audit mode to learn the egress baseline, then tighten to block with an allowlist.

Acceptance

• Harden-Runner runs on the release + security jobs.
• An egress allowlist is captured from audit runs and enforced in block mode (follow-up acceptable for the block flip).