chore(work): decompose 2026-05-14-ci-security-and-supply-chain epic

Decomposer produced 9 stories under docs/work/2026-05-14-ci-
security-and-supply-chain/, ordered to land the schema foundation
first and the cross-referencing content (reviewer prompt, guide)
last:

01 - trace schema extensions (socketRisk + lastRevalidated)
02 - Socket integration (skill + CI)
03 - Renovate adoption
04 - major-bump re-evaluation flow
05 - trace revalidation workflow
06 - CodeQL + audit signatures
07 - gitleaks pre-commit
08 - reviewer prompt update
09 - CI security guide + docs

Also fixes a one-char status typo in the PRD frontmatter
(\`appoved\` -> \`approved\`) that landed with the decompose run.

Anchored by ADR-023 + the approved PRD at
docs/work/prds/2026-05-14-ci-security-and-supply-chain.prd.md.
Sequencing: depends on stories 01/02/04/06 of the in-flight
library-evaluation epic landing first.

docs/work/prds/2026-05-14-ci-security-and-supply-chain.prd.md

@@ -2,7 +2,7 @@
 id: 2026-05-14-ci-security-and-supply-chain
 title: CI security + supply-chain enforcement stack
 type: prd
-status: appoved
+status: approved
 author: danijel
 created: 2026-05-14
 adr: adr-023