ci(quality): install advisory security scanners so Fase 7 gates run (gitleaks/osv/actionlint/zizmor) (#3858)

Integrated into release/v3.8.25 — Fase 7: scanners advisory no CI (gitleaks/osv/actionlint/zizmor).

.github/workflows/ci.yml

@@ -135,6 +135,20 @@ jobs:
         run: npm run check:codeql-ratchet
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      # Fase 7 INT: install the advisory security scanners so the gates below
+      # actually run (they self-skip when the binaries are absent). go install
+      # uses documented module paths (no fragile version-pinned URLs); zizmor is
+      # a PyPI package. Whole job is continue-on-error, so an install hiccup never
+      # blocks the build. Exercised at the next release→main run.
+      - name: Install advisory security scanners (gitleaks/osv/actionlint/zizmor)
+        continue-on-error: true
+        run: |
+          go install github.com/rhysd/actionlint/cmd/actionlint@latest
+          go install github.com/gitleaks/gitleaks/v8@latest
+          go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest
+          echo "$HOME/go/bin" >> "$GITHUB_PATH"
+          pipx install zizmor || pip install --user zizmor
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
       - name: Secret scan (gitleaks; skips if absent)
         run: npm run check:secrets
       - name: Vulnerability ratchet (osv-scanner; skips if absent)