Enforce the public repository boundary

[stc93025mn]

What changed

• Require explicit free standard GitHub-hosted runner labels in public workflows.
• Reject custom, self-hosted, dynamic, and larger-runner labels.
• Reject pull_request_target for public repository checks.
• Reject private MNPPI packages, registries, Git dependencies, actions, and reusable workflows.
• Reject package credential secrets and package authentication variables.
• Document the public pull request boundary.

Why

Public repositories must remain safe for untrusted pull requests and forks. They must not receive private MNPPI dependencies or package credentials. Standard GitHub-hosted runners keep public workflow execution free.

Impact

The current four public repositories pass this policy. A new boundary violation will fail the required public security check.

Validation

• actionlint -shellcheck '' -color=false .github/workflows/public-token-free-security.yml
• Policy passed against the live default branches of all four public repositories.
• Negative fixtures detected runner, event, package, registry, Git, reusable workflow, and credential violations.
• git diff --check