feat(track-c-mvp): C1 action gating + C2 supply-chain gate

C1 (V17) action-gate.sh: gates the ACTION, not just the tool name. Outcome model
  ALLOW/WARN/REQUIRE_APPROVAL/BLOCK. BLOCK on sensitive-file writes (.env, *.pem,
  id_rsa, .github/workflows, .ssh, .aws/credentials, .npmrc) and destructive/
  remote-exec commands (rm -rf /, curl|bash, chmod 777, git push --force);
  REQUIRE_APPROVAL on dependency installs and non-local network egress (clears
  only with an audited CASAN_ACTION_APPROVER). Decisions logged to action-gate.jsonl.
C2 (V18) supply-chain-gate.sh + supply-chain-scan.py: diffs package.json /
  requirements.txt / pom.xml / build.gradle against a baseline (explicit or git
  HEAD). BLOCK on denylisted/known-malicious packages, typosquats (edit-distance 1
  to a known package), and dangerous lifecycle scripts (pre/post/install);
  REQUIRE_APPROVAL on any new dependency. Emits a dep-diff report and records
  which live scanners (npm audit / pip-audit / osv-scanner) are available.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

AINative_OKR_CASAN5/.specify/security/known-packages.txt

@@ -0,0 +1,33 @@
+# Popular package names used for typosquat proximity checks (edit distance <= 1
+# to one of these, but not an exact match, is flagged as a likely typosquat).
+# Extend as the project's real dependency surface grows.
+express
+react
+react-dom
+lodash
+axios
+vite
+tailwindcss
+zod
+prisma
+@prisma/client
+bcrypt
+jsonwebtoken
+class-validator
+class-transformer
+@nestjs/core
+@nestjs/common
+@nestjs/jwt
+@nestjs/swagger
+@tanstack/react-query
+react-router-dom
+react-hook-form
+requests
+flask
+django
+numpy
+pandas
+pytest
+requests-oauthlib
+pyyaml
+cryptography