[codex] harden verification and supply chain for v0.3.2

[wusuiling-if]

What changed

• fail closed when a coding run has no authoritative test command or a recognized zero-test result
• require explicit real model and test command for mca run; keep chat usable in /ask-only mode without enabling coding tools
• add an 11-case offline verified-patch benchmark with exact tool/argument contracts, real Git-diff evidence, resume/Undo coverage, and sanitized JSON output
• add Dependabot, dependency review, dual strict dependency audits, CodeQL, immutable Action pins, least-privilege workflow permissions, bounded jobs, and JSON-only benchmark artifacts
• prepare package metadata and bilingual documentation for v0.3.2

Why

The previous runtime could treat a successful command that collected zero tests as verification, and mca run could fall into a mock/default configuration that was unsuitable for real coding. The repository also lacked a reproducible policy benchmark and enforceable supply-chain controls.

This change makes verification evidence explicit, keeps read-only chat lightweight, and turns the security and release expectations into executable regression tests.

User and developer impact

• mca run now requires both --model and --test-command, and rejects --model mock; use mca demo for the deterministic no-key flow.
• chat without --test-command remains available for /ask, but /code is blocked until authoritative verification is configured.
• recognized zero-test results fail by default; --allow-zero-tests is an explicit weakening.
• the benchmark is offline runtime-policy conformance evidence, not a model-quality or SWE-bench claim.

Validation

• 176 tests passed
• verified-patch benchmark: 11/11, 9 verified submissions, 2 expected refusals, 0 unexpected submissions, 0 unrelated changes
• project and CI dependency audits: no known vulnerabilities
• wheel and sdist built and passed Twine checks
• fresh-wheel version/help/doctor/demo/pip-check smoke passed
• independent whole-branch review: 0 Critical, 0 Important, 0 Minor findings

This PR intentionally does not create a tag or publish to PyPI.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.