ci: run osv-scanner in CI, not push-check (T-353)

Keep the security gate out of the local pre-push path so dev machines
don't need osv-scanner installed. The `make security` target and
ci/osv_scan.sh stay for the CI PR-merge pipeline (and on-demand local
runs); only the push-check prerequisite is removed, with a NOTE in the
Makefile explaining where it runs instead.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -25,11 +25,12 @@ heading, and (b) bumping `pubspec.yaml` `version:` in the same commit.
   `xml` 7.0.1), `mocktail` 1.0.4→1.0.5. Deliberately held with reasons in
   `pubspec.yaml`: `markdown` (7.3.1 needs Dart 3.9), `alchemist` (0.13 golden
   churn), `test` (Flutter-SDK locked). (T-353)
-- **Supply-chain gate in `make push-check`.** A new `security` step runs
-  `osv-scanner` over `pubspec.lock` and fails the push if any resolved
-  dependency has a known advisory — a hard gate on top of `dart pub`'s passive,
-  non-failing advisory print. Requires `osv-scanner` on PATH
-  (`brew install osv-scanner`). (T-353)
+- **Supply-chain gate (`make security`).** A new `security` target runs
+  `osv-scanner` over `pubspec.lock` and fails if any resolved dependency has a
+  known advisory — a hard gate on top of `dart pub`'s passive, non-failing
+  advisory print. Intended for the CI PR-merge pipeline (kept out of
+  `push-check` so dev machines don't need the scanner installed); run locally
+  any time with `make security`. (T-353)
 
 ## [2.3.2] — 2026-06-11
 

Makefile

@@ -309,7 +309,7 @@ clide-cli-clean: ## Remove the compiled C `clide` client.
 # -- security -------------------------------------------------------------
 
 .PHONY: security
-security: ## Supply-chain gate — osv-scanner over pubspec.lock (fails on a known advisory).
+security: ## Supply-chain gate — osv-scanner over pubspec.lock (CI PR-merge pipeline; run locally on demand). Fails on a known advisory.
 	ci/osv_scan.sh
 
 # -- pre-push gate --------------------------------------------------------
@@ -319,7 +319,11 @@ decisions-validate: ## Parser dry-run over governance/{decisions,questions,rejec
 	pql decisions validate
 
 .PHONY: push-check
-push-check: decisions-validate changelog-gate security test-coverage coverage-gate test-core ## Pre-push gate (fast — <2 min target). Order is fail-fast: instant gates (decisions, changelog, security/osv) first, then the coverage suite + gate (the expensive, most-likely-to-fail stage) BEFORE test-core — a coverage miss aborts here instead of after running everything, so a fix doesn't force a full re-run of the rest. test-coverage already runs the a11y suite (test/a11y), so no separate test-a11y pass.
+# NOTE: the `security` (osv-scanner) gate is deliberately NOT in push-check —
+# it runs in the CI PR-merge pipeline (where the scanner is provisioned) so we
+# don't force every dev machine to install osv-scanner. Run it locally any time
+# with `make security`.
+push-check: decisions-validate changelog-gate test-coverage coverage-gate test-core ## Pre-push gate (fast — <2 min target). Order is fail-fast: instant gates (decisions, changelog) first, then the coverage suite + gate (the expensive, most-likely-to-fail stage) BEFORE test-core — a coverage miss aborts here instead of after running everything, so a fix doesn't force a full re-run of the rest. test-coverage already runs the a11y suite (test/a11y), so no separate test-a11y pass.
 
 .PHONY: push-check-full
 push-check-full: push-check test-integration smoke-bundle ## Pre-release gate (push-check + integration + smoke; slower).