chore: security hardening (checklist + CI permissions)

[mlik-sudo]

Summary

• Strengthens security/review.md to require concrete evidence (CI links/logs) and adds CI/LLM-specific checks.
• Tightens GitHub Actions token permissions across workflows and fixes seed-labels behavior.
• Adds dependency-review workflow for PRs.
• Extends Dependabot to monitor harness requirements.
• Adds root SECURITY.md for vulnerability reporting.

Notes

• nightly-bench no longer requests contents: write (was unused).