chore(security): add repository supply-chain governance

.github/dependabot.yml

@@ -0,0 +1,15 @@
+version: 2
+updates:
+  - package-ecosystem: gradle
+    directory: /
+    target-branch: master
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: master
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -21,6 +21,15 @@ jobs:
         run: |
           echo "JAVA_HOME=$JAVA_HOME_11_X64" >> "$GITHUB_ENV"
           echo "$JAVA_HOME_11_X64/bin" >> "$GITHUB_PATH"
+      - name: Verify Gradle wrapper integrity
+        shell: bash
+        run: |
+          expected_sha256="76b12da7f4a7cdd025e5996811a2e49bf5df0fb62d72554ab555c0e434b63aae"
+          actual_sha256="$(sha256sum gradle/wrapper/gradle-wrapper.jar | awk '{print $1}')"
+          if [[ "$actual_sha256" != "$expected_sha256" ]]; then
+            echo "::error file=gradle/wrapper/gradle-wrapper.jar::Gradle wrapper checksum mismatch: expected $expected_sha256, got $actual_sha256"
+            exit 1
+          fi
       - name: Build and test (includes jacoco coverage verification)
         run: ./gradlew build --no-daemon
       - name: Report coverage gaps on failure

SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+This repository follows the
+[ContextualWisdomLab organization security policy](https://github.com/ContextualWisdomLab/.github/blob/main/SECURITY.md).
+Supported versions, disclosure expectations, and the coordinated response
+process are maintained there as the single source of truth.
+
+Do not disclose a suspected vulnerability in a public issue. Submit it through
+[html4tree private vulnerability reporting](https://github.com/ContextualWisdomLab/html4tree/security/advisories/new)
+and include the affected commit or release, reproduction steps, impact, and any
+suggested mitigation.

gradle/wrapper/gradle-wrapper.properties

@@ -1,5 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
 distributionUrl=https\://services.gradle.org/distributions/gradle-5.1.1-bin.zip
+distributionSha256Sum=4953323605c5d7b89e97d0dc7779e275bccedefcdac090aec123375eae0cc798
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists