chore(work): finish epic 2026-05-14-ci-security-and-supply-chain

docs/work/2026-05-14-ci-security-and-supply-chain/09-ci-security-guide-and-docs/_story.md

@@ -3,7 +3,7 @@ id: 09-ci-security-guide-and-docs
 epic: 2026-05-14-ci-security-and-supply-chain
 title: CI security guide + CLAUDE.md
 type: technical-story
-status: in-progress
+status: done
 feature: docs
 depends-on:
   [
@@ -55,4 +55,4 @@ Each prior story lands a machine-enforced layer, but no single document explains
 ## Tasks
 
 - [x] Write `docs/guides/ci-security.md` with: four-pillar overview, per-pillar sections, failure-mode hierarchy table (ADR-023 §5), consumer-toggleable settings list, Socket GitHub App + gitleaks install instructions, CodeQL note for private repos, two worked examples (passing minor-bump PR; blocked major-bump PR + hard-divergence revalidation issue); one commit, all gates pass.
-- [ ] Add CI security Key Conventions bullet to `CLAUDE.md` referencing ADR-023 + `docs/guides/ci-security.md`; one commit, all gates pass.
+- [x] Add CI security Key Conventions bullet to `CLAUDE.md` referencing ADR-023 + `docs/guides/ci-security.md`; one commit, all gates pass.

docs/work/2026-05-14-ci-security-and-supply-chain/_epic.md

@@ -3,7 +3,7 @@ id: 2026-05-14-ci-security-and-supply-chain
 prd: docs/work/prds/2026-05-14-ci-security-and-supply-chain.prd.md
 title: CI security + supply-chain enforcement stack
 type: epic
-status: in-progress
+status: done
 features: [scripts, tooling, docs]
 created: 2026-05-14
 ---