ci(gates): Make API security, build, and artifact checks non-skippable (#395)

[tomasbogado203-bit]

Summary

Resolves #395 (V2-BE-044).

Scope of Changes

• Enforced mandatory, non-skippable API gates across TypeCheck (\ sc --noEmit), Lint, Unit/Integration Tests with Coverage (\ est:cov), Container Vulnerability Scan (\ rivy), and Build Drift Detection.
• Removed unconditional skips and permissive \continue-on-error\ flags.
• Pinned actions to secure versions and configured least-privilege permissions (\permissions: contents: read, \security-events: write).
• Added sensitive changes protection gate requiring human maintainer approval for auth, indexer, database, and workflow modifications.
• Documented local reproduction commands in \docs/local-reproduction.md.

Acceptance Criteria

• Each required job is reproducible locally or in a documented container.
• Deliberate failures in every gate block validation.
• No required result is neutralized by \continue-on-error.
• Fork workflow authorization is documented correctly.
• Changed head SHA requires fresh approval for sensitive work.

[dDevAhmed]

@tomasbogado203-bit intake review of head 8fdb4aff404e857f999f3a03cc99491fb39d01a0: this PR is not eligible to merge yet.

• V2-BE-044 issue V2-BE-044 — Make API Security, Build, and Artifact Checks Non-Skippable #395 is assigned to @dDevAhmed, and the issue contains no maintainer approval authorizing you to implement it. A maintainer must explicitly approve the author/assignment relationship on the issue.
• The canonical baseline work for the same task already landed through PR ci: remove placeholder API gates and minimize permissions #442. A maintainer must confirm whether this PR is an approved focused remediation/replacement and define the non-duplicative remaining acceptance criteria; otherwise close it as duplicate.
• GitHub currently reports the PR as not mergeable, so rebase/resolve the branch against main after scope authorization.
• The exact-head workflow Backend CI Security and Quality Gates is action_required. This requires maintainer workflow authorization, not contributor code changes. Once authorized, all required lint, typecheck, test/coverage, migration, artifact-drift, dependency/security, container, Trivy, secret-scan, and CodeQL gates must complete successfully.
• Because this changes CI/security controls, an independent human maintainer approval is required on this exact SHA after all changes and checks.

Please obtain issue authorization and the remediation scope decision first, then resolve conflicts and request fresh exact-head CI/review.