ci: expand host-verify with lint, typecheck, security, depscan and coverage gates

Phase 1 of audit-hardening CI expansion (baseline origin/main aebc623):
- lint: ruff E9 hard gate; full E,F@120 report-only (baseline 111 items)
- typecheck: mypy default mode, production scope, report-only (baseline 24)
- security: bandit production scope, report-only (baseline 287, High 5)
- depscan: pip-audit on requirements-ci.txt, hard gate (0 vulns; repo has
  no production dependency manifest, see summary)
- coverage: production 58 files, fail-under=75 (baseline measured 76%)
- release build: E9 + pip-audit hard gates before packaging; full reports
  stay in host-verify to avoid drift
No production code changed; CI billing failure mode unchanged.

requirements-ci.txt

@@ -0,0 +1,10 @@
+# CI 工具链固定版本（host-verify / release 共用）。
+# 只含 CI 检查工具，不含生产运行依赖：生产代码除宿主侧延迟加载的
+# psycopg/psycopg2 驱动外只用标准库，仓库内无 requirements 清单，
+# 因此 pip-audit 目前只能审计本文件（见 workflow 注释与 PR 摘要）。
+# 升级版本时须同步本地试跑结果，禁止只改版本号不验证。
+ruff==0.17.3
+bandit==1.9.4
+mypy==2.4.1
+coverage==7.17.0
+pip-audit==2.10.1