ci(release): add secret and SAM verification gates

[Naim-arg]

Summary

Adds reproducible local and GitHub release gates for OME MemoryGuard without deploying or contacting live AWS/CockroachDB resources.

What changed

• added gitleaks history and working-tree scans with a narrowly scoped synthetic-fixture allowlist
• added Windows-safe SAM validation/build through an isolated ASCII-only temporary copy
• extended the local verification script with pip, gitleaks, and SAM gates
• added pinned GitHub Actions jobs for Python/template quality, secrets, and SAM packaging
• updated verification and AWS runbook documentation
• added architecture contract coverage for helper scripts and pinned action SHAs

Files changed

• .github/workflows/ci.yml
• .gitleaks.toml
• scripts/secret-scan.ps1
• scripts/sam-verify.ps1
• scripts/verify.ps1
• tests/test_architecture.py
• README.md
• docs/AWS_DEPLOYMENT.md
• docs/VERIFICATION.md

Tests/checks run

• scripts\verify.ps1 -WithGitleaks -WithSam
• 34/34 unittest and pytest tests passed
• compileall, pip check, Ruff, and cfn-lint passed
• gitleaks Git history and working-tree scans passed
• SAM CLI 1.165.0 validate/build passed
• PowerShell parser and workflow YAML checks passed
• staged diff check passed

Screenshots / manual verification

No runtime UI was changed, so screenshots were not required.

Risks / limitations

• no AWS deployment or paid resource operation was performed
• no live CockroachDB connection or schema write was performed
• no production authentication/authorization was added
• one upstream Starlette TestClient/httpx deprecation warning remains

Rollback notes

Revert commit 91cec98c01ff935aa6116ff573531bd673986714. The change adds only verification scripts, CI configuration, tests, and documentation.