test: add security coverage false-green fixtures

[saagpatel]

What

Adds controlled GitHub security coverage fixtures and tests for false-green prevention in the count-only evidence pipeline.

Why

The portfolio security convergence lane needs proof that known vulnerable dependencies, code-scanning findings, workflow-permission failures, and missing-provider states do not collapse into a misleading zero-findings success story.

Review Of What Was Built

• Added reusable outcome fixtures for known vulnerable Dependabot alerts, code-scanning findings, workflow permission 403 responses, and missing provider 404 responses.
• Added a test proving a Dependabot vulnerability remains an observed non-zero finding while adjacent code-scanning and secret-scanning provider failures stay incomplete and countless.
• Added a test proving code-scanning alert payloads produce non-zero counts rather than zero findings.

Cleanup Review

No production behavior changed. No generated portfolio truth output was refreshed. The change is limited to tests/fixtures/github_security_coverage/outcomes.json and tests/test_github_security_coverage.py.

Verification Summary

• uv run --extra dev python -m pytest -q tests/test_github_security_coverage.py: 157 passed
• uv run --extra dev python -m ruff check tests/test_github_security_coverage.py: All checks passed
• python3 -m json.tool tests/fixtures/github_security_coverage/outcomes.json >/dev/null: passed
• git diff --check: passed

Shipped Summary

Branch codex/github-security-false-green-fixtures-20260824 now has fixture-backed regression coverage for the main false-green security coverage hazards.

Next Phase

Review and merge this PR when ready, then rerun the GitHub security coverage receipt and provider readback after merge. Merge remains approval-gated.

Remaining Roadmap

• Merge the prepared green remediation/security coverage PRs after exact approval.
• Refresh default-branch provider state after merges.
• Resolve any remaining validated provider alerts or settings proposals through approved lanes.