chore: harden validation workflow and add SECURITY.md

what:
- SHA-pin actions/checkout@v6 in both validation jobs
- Pin awesome-lint to 2.3.0 instead of using latest through npx
- Add push trigger and broaden path filters to include criteria,
  contributing, SECURITY.md, workflow, and validation script changes
- Remove unused pip install pyyaml and use explicit python3
- Add SECURITY.md with vulnerability reporting and signing-boundary note

why:  Reduce CI supply-chain drift, ensure validation runs when its own
      rules change, remove dead dependency setup, and document the
      repo's vulnerability reporting path.

Author: CodeSigils

.github/workflows/validate.yml

@@ -4,9 +4,24 @@ on:
   workflow_dispatch:
   schedule:
     - cron: '0 6 * * 1'   # weekly, Monday 06:00 UTC
+  push:
+    branches: [main]
+    paths:
+      - 'README.md'
+      - 'CRITERIA.md'
+      - 'contributing.md'
+      - 'SECURITY.md'
+      - '.github/scripts/**'
+      - '.github/workflows/validate.yml'
   pull_request:
     branches: [main]
-    paths: ['README.md']
+    paths:
+      - 'README.md'
+      - 'CRITERIA.md'
+      - 'contributing.md'
+      - 'SECURITY.md'
+      - '.github/scripts/**'
+      - '.github/workflows/validate.yml'
 
 permissions:
   contents: read
@@ -15,19 +30,17 @@ jobs:
   awesome-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - name: Run awesome-lint
-        run: npx awesome-lint
+        run: npx --yes awesome-lint@2.3.0
 
   validate-repos:
     runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
-      - name: Install dependencies
-        run: pip install pyyaml
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - name: Validate all listed repos exist and are active
-        run: python .github/scripts/validate-repos.py
+        run: python3 .github/scripts/validate-repos.py
         env:
           GH_TOKEN: ${{ github.token }}

SECURITY.md

@@ -0,0 +1,22 @@
+# Security Policy
+
+## Supported Versions
+
+This repo is a curated public awesome list with supporting validation tooling.
+There are no versioned releases — always use the latest commit from `main`.
+
+## Reporting a Vulnerability
+
+This project contains no secrets, runtime service, or deployed application. It
+ships a curated README plus GitHub Actions validation for listed repositories.
+If you find an issue with the content, criteria, or validation logic, please
+open a public issue on GitHub.
+
+Do **not** open a public issue if the vulnerability involves the GitHub Actions
+workflow itself, such as leaked CI logs or token exposure. Report privately to
+the repository owner via GitHub's security advisory tool.
+
+## Commit Signing
+
+Maintainer commits from 2026-07-05 onward are SSH-signed. Earlier commits may
+be unsigned and are retained to avoid rewriting public history.