feat(security): implement zero trust, incident response, and secure SDLC

[Akanimoh12]

Closes #468
Closes #469
Closes #470
Closes #471

Summary

This umbrella PR adds the requested security and infrastructure controls:

• Zero-trust Kubernetes manifests with Istio strict mTLS, default-deny authorization, namespace network policies, and identity-aware admin access controls.
• Incident-response automation with ten scenario runbooks, severity-based stakeholder routing, allowlisted containment commands, dry-run support, and quarantine policy execution.
• Secure SDLC controls with STRIDE threat modeling, security champion guidance, pre-commit checks, Semgrep, Gitleaks, Trivy, npm audit, and cargo audit CI gates.
• Liquidation-engine protections already present in the loan manager are retained and covered by the existing liquidation tests, including configurable incentives and the 20% bonus cap.

Validation

• YAML configuration parsing passed for the security workflow, pre-commit configuration, and Kubernetes manifests.
• Incident catalog JSON validation passed with ten runbooks.
• git diff --check passed.
• Contract test execution was unavailable in the local tool environment; CI should run the repository's Rust checks before merge.

Review Notes

The Kubernetes manifests assume Istio and the referenced operational CronJobs are installed by the deployment platform. The incident runner defaults to live execution only when explicitly invoked without --dry-run; operators should validate credentials and RBAC in staging first.

Checklist

• Read and followed CONTRIBUTING.md.
• Used a feature branch and Conventional Commits.
• Updated documentation and PR checklist.
• Added the requested infrastructure and operational artifacts.
• Maintainer review of deployment-specific RBAC and liquidation protocol economics remains required before production rollout.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ba6849c8-5d46-4e1d-9804-0bf20771c8c4

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[drips-wave]

@Akanimoh12 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits