CIH-S03: Run dependency-review on PRs and fence the push trigger #170

Severity: Medium (no PR-time check of new dependencies or their licences) · Epic: CIH · Landing order: 4 of 21 · Blocked by: none

No actions/dependency-review-action runs on PRs. Add a SHA-pinned, pull_request-only job at the action's default fail-on-severity (loosen only after a measured trial with a # why: line), with allow-licenses (Apache-2.0-compatible set) plus per-module allow-dependencies-licenses each with a reason; not the deprecated deny-licenses (action issue #938). Forbidden: verify.yaml losing push.branches: [main] or the weekly schedule (hack/release/verify-tag-gate.sh needs a green run on the tag SHA; assent uses rebase-merge).

Spec: openspec/specs/p5-cih-ci-hardening/spec.md — CIH-S03, REQs REQ-CIH-S03-01, REQ-CIH-S03-02, REQ-CIH-S03-03; proposed in #166. Gate-wiring rule: openspec/specs/README.md (every new guard, every mode, runs on pull_request in verify).

Operator steps:

• Make the dependency-review job a required check in branch protection (after the PR lands).

Acceptance (one PR; TDD — failing test first):

• REQ-CIH-S03-01 — PR-only job, pinned, no continue-on-error, allow-licenses present, no deny-licenses — bash hack/lint/workflow_pins_test.sh
• REQ-CIH-S03-02 (adversarial) — severity override without # why: or the step dropped is red (inline control) — bash hack/lint/workflow_pins_test.sh
• REQ-CIH-S03-03 (forbidden outcome) — on: keeps push.branches: [main] and schedule, with a comment citing verify-tag-gate.sh — bash hack/lint/workflow_pins_test.sh

Done when: every REQ's Verify passes on the PR (or is post-merge with its follow-up issue linked), task check is green, and the gate-wiring rule holds.

Source: spec/oss-quality-signals @ 94be853 (independent review + cold adversarial review, 2026-10-05).