ci: add supply-chain-lint gate

[rafalry]

Summary

Adds the fleet-standard supply-chain-lint gate, part of closing the gate:supply-chain-lint finding category from the weekly repo-security-lint sweep (PSEC-5231).

What it does

supply-chain-lint scans vendored GitHub Action definitions (action.yml/action.yaml and sibling .sh scripts) for runtime supply-chain risks — runtime installs that bypass lockfiles (npm install, npx, curl | bash), and unpinned versions (@latest, --no-lockfile).

xpub-tool is a public repo, so it must not reference (or hold credentials for) the private swan-bitcoin/actions repo. Following the check-linear-link precedent (#72), the action is vendored into the repo at .github/actions/supply-chain-lint/ — a verbatim copy of swan/supply-chain-lint from swan-bitcoin/actions@63912e4 (action.yml, supply-chain-lint.sh, built-in allowlist). It is a self-contained bash composite with no transitive uses: refs, so the copy has no external references to pin. The workflow checks out the repo (SHA-pinned actions/checkout) and runs the local action.

The scanner deliberately skips .github/, and this repo's vendored actions all live there — so the lint scans 0 files today and passes as a no-op (verified locally). It acts as a tripwire for any vendored action added outside .github/ later.

Verification

Ran the vendored script locally against the branch worktree: Scanning 0 files... No supply chain violations found. The gate:supply-chain-lint check in repo-security-lint greps workflows for the action ref — this workflow satisfies it; the next weekly fleet sweep will confirm.

Pre-existing issue (not addressed here)

.github/workflows/dependency-review.yml on master still references the private mirror (swan-bitcoin/actions/...@master), which cannot resolve from this public repo — it fails at workflow-prep on every PR (all runs since 2026-06-26 failed with zero jobs). It needs the same public-repo treatment (SHA-pinned upstream actions/dependency-review-action; the analyze-dependency-changes job has transitive mirror refs — PSEC-4907 precedent). Tracked in PSEC-5231's Linear thread.

🤖 Generated with Claude Code