security: add reproducible dependency and toolchain vulnerability gates

Summary

Add reproducible, lock-aware vulnerability gates that distinguish deployed runtime exposure from build-only tooling and require reviewed expiring exceptions. Owner surfaces: Go module files, .github/workflows/, image toolchain pins, dashboard/frontend/package-lock.json, website/package-lock.json, Cargo lockfiles, and src/vllm-sr/uv.lock.

Current behavior

The repository has confirmed advisories in committed dependency graphs, floating patch-level toolchain selection, and no unified required gate that classifies runtime, build-only, reachable, and accepted findings. Python audit results can also depend on audit-day resolution rather than a committed graph.

Expected behavior

Every ecosystem is scanned from committed resolution artifacts with pinned patched toolchains, runtime and build-only findings are reported separately, and any exception has an owner, rationale, exposure classification, and expiry.

Acceptance

• Run govulncheck for production Go modules and pin a patched Go release consistently in workflows and images.
• Scan dashboard production and website build-only dependency graphs separately.
• Scan Cargo and Python from committed lock or resolution artifacts.
• Store exceptions in a machine-readable allowlist with owner, rationale, class, and expiry.
• Block reachable or runtime critical/high regressions in PRs; publish complete scheduled scan artifacts without masking failure.

Validation

• Add deterministic fixtures for a clean graph, a blocking runtime advisory, an allowed unexpired finding, and an expired exception.
• Prove lockfile and toolchain drift fails the gate.
• Run the new gate in a clean checkout and through make agent-pr-gate.
• Document ecosystem scope and runtime/build classification in the workflow summary.

Related

• Parent audit: #2375