ci: add osv-scanner supply-chain gate to push-check (T-353)

`make push-check` now runs a `security` step (ci/osv_scan.sh) that scans
pubspec.lock with osv-scanner and fails the push if any resolved
dependency has a known advisory. This is a hard, fail-closed gate on top
of `dart pub get`'s passive (non-failing) advisory print.

Replaces the old manual-review `security` no-op target. Slots in among
the instant fail-fast gates, before the coverage suite. Resolves the
osv-scanner binary from PATH, falling back to a brew prefix so the gate
works under the pre-push hook's leaner PATH; if absent it fails with an
install hint (brew install osv-scanner). Native deps (dugite,
tree-sitter, wasmtime) are vendored by SHA and reviewed separately on
bump (D-42), so they're out of scope for the lockfile scan.

Verified clean against the current lockfile (80 packages, no issues).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -25,6 +25,11 @@ heading, and (b) bumping `pubspec.yaml` `version:` in the same commit.
   `xml` 7.0.1), `mocktail` 1.0.4→1.0.5. Deliberately held with reasons in
   `pubspec.yaml`: `markdown` (7.3.1 needs Dart 3.9), `alchemist` (0.13 golden
   churn), `test` (Flutter-SDK locked). (T-353)
+- **Supply-chain gate in `make push-check`.** A new `security` step runs
+  `osv-scanner` over `pubspec.lock` and fails the push if any resolved
+  dependency has a known advisory — a hard gate on top of `dart pub`'s passive,
+  non-failing advisory print. Requires `osv-scanner` on PATH
+  (`brew install osv-scanner`). (T-353)
 
 ## [2.3.2] — 2026-06-11