ci: expand host-verify with lint, typecheck, security, depscan and coverage gates

Phase 1 of audit-hardening CI expansion (baseline origin/main aebc623):
- lint: ruff E9 hard gate; full E,F@120 report-only (baseline 111 items)
- typecheck: mypy default mode, production scope, report-only (baseline 24)
- security: bandit production scope, report-only (baseline 287, High 5)
- depscan: pip-audit on requirements-ci.txt, hard gate (0 vulns; repo has
  no production dependency manifest, see summary)
- coverage: production 58 files, fail-under=75 (baseline measured 76%)
- release build: E9 + pip-audit hard gates before packaging; full reports
  stay in host-verify to avoid drift
No production code changed; CI billing failure mode unchanged.

.github/workflows/release.yml

@@ -42,6 +42,16 @@ jobs:
           python3 -m unittest discover -s tests -v
           python3 -m unittest discover -s cloud/tests -v
           python3 -m unittest discover -s deploy/tests -v
+      # CI 扩项在发布链路的最小硬门禁：语法 E9 + CI 工具链依赖扫描。
+      # 全量 lint/mypy/bandit 报告与覆盖率门槛只在 host-verify 里跑
+      # （PR 与 main 推送都会跑，走到 tag 的提交此前已过 host-verify），
+      # 这里不重复跑三套报告，避免发布作业与 host-verify 的检查漂移；
+      # 这里的两项是硬失败，失败则不产发布包。
+      - name: CI 扩项硬门禁（语法 + 依赖扫描）
+        run: |
+          pip install -r requirements-ci.txt
+          ruff check --select E9 .
+          pip-audit -r requirements-ci.txt
       - name: 构建发布包（git archive + DEPLOYED_COMMIT + sha256）
         id: build
         run: |