ci: expand host-verify with lint, typecheck, security, depscan and coverage gates

Phase 1 of audit-hardening CI expansion (baseline origin/main aebc623):
- lint: ruff E9 hard gate; full E,F@120 report-only (baseline 111 items)
- typecheck: mypy default mode, production scope, report-only (baseline 24)
- security: bandit production scope, report-only (baseline 287, High 5)
- depscan: pip-audit on requirements-ci.txt, hard gate (0 vulns; repo has
  no production dependency manifest, see summary)
- coverage: production 58 files, fail-under=75 (baseline measured 76%)
- release build: E9 + pip-audit hard gates before packaging; full reports
  stay in host-verify to avoid drift
No production code changed; CI billing failure mode unchanged.

.coveragerc

@@ -0,0 +1,27 @@
+# Coverage 配置：只计量生产代码，测试本身、工作区、示例不计。
+# 阈值不在此文件写死，写在 workflow 的 --fail-under 里，便于在
+# workflow diff 中一眼看到门槛变化。
+# source 注意：不能写 host.py / client.py / run_parallel.py 这种文件
+# 路径——coverage 会把它们当模块名处理、静默丢弃（实测：那样 host.py
+# 等 3 个根文件根本不进报告，总数少 2223 行）。正确写法是目录源
+# “.”（含根模块与 cloud 包）+ deploy（非包目录，需单独列），
+# 实测恰好 58 个生产文件、22392 行，与 mypy 生产文件数一致。
+[run]
+source =
+    .
+    deploy
+omit =
+    */tests/*
+    */test_*.py
+    cloud/tests/*
+    deploy/tests/*
+    tests/*
+    work/*
+    examples/*
+
+[report]
+show_missing = False
+exclude_lines =
+    pragma: no cover
+    def __repr__
+    raise NotImplementedError