ci/security/test: automated audit fixes for CryptoStrategies

[Pigbibi]

Summary

• harden Codex audit gate output to avoid echoing matched secret-like snippets
• add regression coverage for gate redaction behavior
• expand CI and local verification docs to include dependency checks and package build

Problems found

• static gate findings could print matched secret-like fragments into workflow logs and summaries
• CI did not validate dependency consistency or package buildability
• CONTRIBUTING local verification command drifted from actual CI expectations

Fixes applied

• redact hardcoded-secret findings to field=<redacted> in scripts/gate_codex_app_review.py
• add tests/test_gate_codex_app_review.py regression coverage
• add python -m pip check and python -m build to .github/workflows/ci.yml
• align CONTRIBUTING.md verification commands with current CI flow

Security impact

• lowers risk of leaking secret-like literals via gate diagnostics and PR summaries
• no production credentials, broker settings, or runtime strategy permissions changed

Architecture impact

• no public strategy API changes
• keeps audit concerns within workflow/gate boundaries instead of strategy modules

Tests run

• actionlint
• python -m pip check
• ruff check .
• python -m pytest -q tests --cov --cov-report=term --cov-report=xml
• python -m build
• python -m pip_audit
• git diff --check

Failed or skipped checks with reasons

• none locally
• ruff emits an existing config deprecation warning for top-level ignore; not changed in this PR

Deployment notes

• no production deployment workflow triggered by this PR
• repository changes affect CI/gate behavior and contributor verification only

Rollback plan

• revert commit 923dc7a or close PR before merge

Manual follow-up checklist

• migrate pyproject.toml Ruff config from top-level ignore to lint.ignore
• review and merge after required checks pass