docs(ci-security): add CI security guide + CLAUDE.md convention bullet

Covers the four-pillar stack (Renovate, Socket, trace revalidation,
GitHub-native gates), the failure-mode hierarchy table from ADR-023 §5,
consumer-toggleable settings, Socket App + gitleaks install instructions,
CodeQL private-repo note, and two worked examples (minor-bump auto-merge;
major-bump block + hard-divergence revalidation issue).

CLAUDE.md Key Conventions gains the CI security bullet pointing to
ADR-023 + docs/guides/ci-security.md for agent discoverability.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -125,6 +125,7 @@ See `docs/guides/coverage.md` for the cookbook and ADR-020 for the full rational
 - **Self-asserting `bindProductionX(ctx)`** — every feature's bind-production calls `assertFeatureConformance(container, manifest, symbols, ctx)` at its tail. `pnpm dev` refuses to boot on drift
 - **`pnpm conformance`** — cross-feature event-closure check; fails CI on orphan consumers
 - **New runtime dependencies require a library trace** — adding a runtime dependency to a feature- or core-tier package requires a trace at `docs/library-decisions/<date>-<name>.md` produced by the `/evaluate-library` skill; see ADR-022 and `docs/guides/adding-a-library.md`
+- **CI security + supply-chain enforcement** — Renovate for bumps + Action SHA pinning, Socket for supply-chain behavior, weekly trace revalidation, CodeQL + audit signatures + gitleaks. See ADR-023 + `docs/guides/ci-security.md`
 
 ## MCP Servers