Add a local resource path portability audit

[maziyarpanahi]

Description

Adds a deterministic, local-only audit for resource-path portability. It reports only normalized SHA-256 fingerprints, issue categories, and occurrence counts while detecting traversal, host-specific roots, Windows-reserved components, Unicode normalization drift, and case-fold collisions.

The review repair bounds path count, size, and component count; contains hostile iterator and path-like hooks; validates immutable report state; preserves UNC identity; detects Unicode-only normalization drift; and covers Windows invalid/control characters without echoing source paths.

Type of Change

• New feature
• Documentation update
• Test addition/improvement

Changes Made

• Added an offline path portability audit with canonical hash-only reports.
• Added bounded, value-free input handling and strict report invariants.
• Published the security guide in documentation navigation and the changelog.

Testing

• Tests prove the feature and hardening paths.
• New and existing core unit tests were exercised.
• Traversal, roots, reserved names, Unicode drift, collisions, bounds, hostile hooks, and invalid public state were covered.

Commands run:

• .venv/bin/python -m pytest tests/unit/core/test_path_portability.py -q — 23 passed
• .venv/bin/python -m pytest tests/unit/core -q — 2,671 passed and 3 skipped; the sole socket-restricted sandbox failure passed on isolated rerun
• .venv/bin/python -m pytest tests/unit/test_docs_publication.py tests/unit/release/test_changelog.py tests/unit/test_public_api_docstrings.py -q — 27 passed
• .venv/bin/python -m mypy openmed/core/path_portability.py — passed
• .venv/bin/pre-commit run --files ... — passed
• .venv/bin/python scripts/docs/stage_pages.py — strict staged Pages build passed

Documentation

• Documentation and navigation updated
• Public APIs have docstrings
• CHANGELOG.md updated

Code Quality

• Canonical Ruff format and lint checks passed
• Self-review completed
• No new warnings from the changed files

Dependencies

• No new dependencies

Related Issues

Closes #2637

Screenshots/Examples

Not applicable; this is a Python audit contract with canonical JSON output.