docs(security): add GitHub Actions security audit methodology

[smartwatermelon]

Summary

Documents the methodology used in the 2026-04-29 inaugural GitHub Actions security audit (the manual run that produced 9 PRs across the smartwatermelon/* and nightowlstudiollc/* repos) and codifies it for re-use by:

1. Future ad-hoc human audits.
2. The recurring quarterly remote agent (routine trig_01JaKYSFQhPJoc3jADyQPBgM), which fires next on 2026-07-01T17:00Z and reads this doc as its source of truth.

Contents

• Source: link to the Nesbitt article that catalogs the nine attack patterns
• In-scope filter: gh repo list commands with the isArchived / isFork gates
• The 9 vulnerability patterns with detection commands + remediation guidance for each
• Severity rubric (blast radius × exploitability)
• Mitigation framework (Tier 1/2/3 by cost-to-fix and exposure — the same triage I used in April)
• Tooling pointers (zizmor, pinact, ratchet)
• Recurring agent reference (routine ID, cadence, deliverables)
• Audit history table with the 2026-04-29 row pre-filled

Recurring-agent contract

The agent's prompt is hard-coded to read this doc. Methodology changes propagate automatically on the next run. The agent is instructed NOT to modify this doc directly — if it discovers something the methodology should cover, it files an issue labeled audit-methodology-update and a human (you) decides what to merge.

Test plan

• Doc renders cleanly on GitHub
• Manual smoke-test: re-run the inaugural audit's enumeration commands from the in-scope filter section, confirm the 29-repo count
• First quarterly run on 2026-07-01 produces an issue and follows the structure described

🤖 Generated with Claude Code