Harden public delivery and HTTP deployment guardrails

[superWorldSavior]

Scope

Harden public-repository delivery and HTTP deployment hygiene for the standalone provider. Do not change MCP tool schemas, CAD semantics, tags, releases, or package/image versions.

The provider intentionally executes arbitrary Python. The current bootstrap binds to loopback by default, but HTTP is started with cors: true and no built-in authentication. Non-loopback exposure therefore needs an explicit, documented trust boundary rather than relying on callers to infer it.

Current-state findings

• .github/workflows/publish.yml runs check / image-smoke on pushes to main, but not on pull requests targeting main.
• GitHub Actions are referenced by mutable major-version tags (for example actions/checkout@v5, denoland/setup-deno@v2, docker/build-push-action@v6) rather than immutable commit SHAs.
• server.ts binds to 127.0.0.1 by default, but --hostname=0.0.0.0 can expose the unauthenticated arbitrary-Python endpoint.
• HTTP currently uses wildcard CORS through cors: true and has no authentication layer in the bootstrap.
• The README warns that arbitrary Python is not sandboxed, but deployment guidance should state the CORS/auth boundary as explicitly as the execution boundary.

Acceptance criteria

• The non-publishing check and image-smoke jobs run for pull requests targeting main and for pushes to main. JSR and GHCR publication remain tag-only.
• main branch protection requires a pull request and successful non-publishing checks before merge.
• Every GitHub Action reference in .github/workflows/publish.yml is pinned to an immutable commit SHA.
• GitHub secret scanning and Dependabot security updates are enabled for this public repository.
• README.md explicitly states that the HTTP bootstrap has wildcard CORS and no authentication.
• Deployment guidance states that HTTP must remain loopback-only or sit behind an authenticated reverse proxy / equivalent authenticated deployment boundary before any non-loopback exposure.
• The existing warning that submitted Python is not sandboxed and has the authority of the host/container user remains prominent.
• Optional hardening: if a non-loopback hostname is selected directly, require an explicit unsafe-exposure acknowledgement or emit a prominent startup warning. This must not silently imply that CORS is an authentication mechanism.

Verification

• deno test --allow-all tests/ passes, including an updated workflow-invariant test.
• A pull request run completes the non-publishing jobs without attempting a registry upload.
• GitHub branch-protection and security settings show the required controls enabled.
• Documentation review confirms the exact CORS/auth, loopback/proxy, and arbitrary-Python boundaries.
• A local HTTP smoke still succeeds on 127.0.0.1; any added non-loopback warning/acknowledgement is covered by a focused bootstrap test if practical.