chore(security): add repo sentinel adoption gate

[stacknil]

Summary

• add a production-PyPI repo-sentinel gate pinned to repo-sentinel-lite==0.6.3
• ignore reproducible output directories while keeping source, configs, and committed sample inputs in scope
• lock the intended scan boundary with integration tests

Validation

• python -m pytest -q (177 passed)
• python scripts/regenerate_artifacts.py --check (23 strict artifacts matched; 6 visual snapshots regenerated)
• repo-sentinel scan --fail-on-severity error --format text . (No findings)
• deterministic entropy probe at threshold 4.5 (6.0000 detected)
• git diff --check

Security / privacy

• no baseline or generated artifacts added
• scan output remained redacted
• workflow permissions are read-only