feat(track-c-mvp): C1 action gating + C2 supply-chain gate

C1 (V17) action-gate.sh: gates the ACTION, not just the tool name. Outcome model
  ALLOW/WARN/REQUIRE_APPROVAL/BLOCK. BLOCK on sensitive-file writes (.env, *.pem,
  id_rsa, .github/workflows, .ssh, .aws/credentials, .npmrc) and destructive/
  remote-exec commands (rm -rf /, curl|bash, chmod 777, git push --force);
  REQUIRE_APPROVAL on dependency installs and non-local network egress (clears
  only with an audited CASAN_ACTION_APPROVER). Decisions logged to action-gate.jsonl.
C2 (V18) supply-chain-gate.sh + supply-chain-scan.py: diffs package.json /
  requirements.txt / pom.xml / build.gradle against a baseline (explicit or git
  HEAD). BLOCK on denylisted/known-malicious packages, typosquats (edit-distance 1
  to a known package), and dangerous lifecycle scripts (pre/post/install);
  REQUIRE_APPROVAL on any new dependency. Emits a dep-diff report and records
  which live scanners (npm audit / pip-audit / osv-scanner) are available.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

AINative_OKR_CASAN5/.specify/security/malicious-packages.txt

@@ -0,0 +1,17 @@
+# Known-bad / denylisted package identifiers. Format: one entry per line, either
+# a bare name (any version) or name@version for a specific pinned bad release.
+# This is a LOCAL denylist used when no live CVE/OSV scanner is available; a real
+# deployment should also run npm audit / pip-audit / osv-scanner (the gate runs
+# them when present and records tool availability in the report).
+#
+# The entries below are illustrative fixtures (documented malware families /
+# typosquat campaigns) so the gate has deterministic denials to test against.
+event-stream@3.3.6
+flatmap-stream
+coa@2.0.3
+rc@1.2.9
+ua-parser-js@0.7.29
+node-ipc@10.1.1
+colors@1.4.44-liberty-2
+crossenv
+cross-env.js