feat(api): bind org .github workflows as CI/review/security only

[seonghobae]

Summary

#37–#54 remain review-blocked (no independent APPROVE). #45 marked ready (preferred merge after #37). Next no-0008 buyer/ecosystem gap: org-central .github reusable-workflow interchange on origin/main (distinct from naruon #42 and orchestrator #52).

• Bind ContextualWisdomLab/.github/.../workflows/*.yml@ref as CiReviewSecurity only
• Table / JDBC / SQL / postgres targets fail closed
• COPILOT_GITHUB_TOKEN and review-agent GitHub secrets refused
• NVIDIA_NIM_API_KEY is the only allowed model-credential name
• refuse_check_conclusion_as_scientific_claim always denies nonempty conclusions

No migration 0008. Did not recreate topic_measurement, psychometric_core, compute_backend, or concept_dictionary.

Test plan

• RED: org_github_contract failed with E0432
• cargo test -p tepp_api --offline
• cargo clippy -p tepp_api --all-targets --offline -- -D warnings
• python3 scripts/validate_documentation.py and check_docstrings.py
• python3 scripts/check_coverage.py --kind lines --format lcov on tepp_api (187/187)
• exact-head required Checks (do not treat queued evidence as passed)

Do not self-approve or merge. Prefer merge #37 then #45 when eligible. Do not allocate 0008.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ae0e1576-80f9-4a35-a4c7-cda3b964bb05

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}