fix: retain security evidence when artifact delivery fails

[rldyourmnd]

Summary

Private consolidated security jobs fail after successful scans when GitHub artifact storage refuses the final report upload. Both variants now require a complete checksummed run-log ZIP when artifact upload fails. The archive preserves all four redacted reports and exact run identity; missing, symlinked, non-regular, changing, malformed or oversized inputs fail closed. Scanner failures remain blocking regardless of delivery outcome.

Refresh two expired GitLab allowance records from their current primary sources, with separate review deadlines.

Type of change

• Fix to an existing workflow
• Hardening / security posture improvement

Threat-model note

No additional destination or authentication authority. The fallback uses the existing private run log and visibility. It opens only four fixed report names with no-follow/nonblocking descriptors, bounds every input to 4 MiB, validates SARIF and capture stability, and emits base64 only after a complete deterministic ZIP exists. SHA-256, byte count, member checksums, repository, source commit, run and attempt permit exact recovery. Failure of both transports and scanner failures remain failures. Native SARIF publication in the paid variant is unchanged.

Permissions diff

No permission changes. Private-free remains contents: read; the paid variant retains its existing actions: read, contents: read and security-events: write scopes.

Validation

• validate_all.py through the isolated launcher: all tiers pass.
• Python execution contract and syntax pass.
• Native transport probe round-trips the exact bytes twice and rejects missing, symlinked, FIFO, oversized and malformed reports.
• Workflow checks enforce fallback delivery and retained scanner failure semantics in both variants.
• actionlint and authenticated pinned zizmor pass; shellcheck passes for the new helper.
• Catalog, examples, generated documents and changelog updated. Existing action pins and tool used_by sets are unchanged.

Hosted fallback execution is a consumer rollout check, not claimed by these local tests.