ci: expand host-verify with lint, typecheck, security, depscan and coverage gates

Phase 1 of audit-hardening CI expansion (baseline origin/main aebc623):
- lint: ruff E9 hard gate; full E,F@120 report-only (baseline 111 items)
- typecheck: mypy default mode, production scope, report-only (baseline 24)
- security: bandit production scope, report-only (baseline 287, High 5)
- depscan: pip-audit on requirements-ci.txt, hard gate (0 vulns; repo has
  no production dependency manifest, see summary)
- coverage: production 58 files, fail-under=75 (baseline measured 76%)
- release build: E9 + pip-audit hard gates before packaging; full reports
  stay in host-verify to avoid drift
No production code changed; CI billing failure mode unchanged.

ruff.toml

@@ -0,0 +1,11 @@
+# Ruff 配置：第一阶段只开 E + F（pyflakes 正确性 + pycodestyle 基础）。
+# 不开全规则：全规则在基线 aebc623 下有 2332 项（含 UP031 printf 格式
+# 1113 项等风格 churn），一次性全开只会把 CI 变成常红噪音，不先收敛。
+# 行宽 120：88 下 E501 有 131 项、100 下 29 项、120 下 13 项；
+# 120 是现有代码最接近的、可在第二阶段再收紧到 100 的起点。
+# 排除 work/：它是运行时 worktree/任务工作区，不是源码。
+line-length = 120
+exclude = ["work"]
+
+[lint]
+select = ["E", "F"]