Add a security gate workflow that scans pull requests for malicious .pth file additions or renames. .pth files are a known Python security risk as they allow arbitrary code execution at interpreter startup. The workflow will fail the check if any .pth files are detected, prompting the author to rename legitimate fixtures to .pth.txt.
chore: remove malicious.pth file
The file was identified as potentially harmful and has been deleted to maintain repository security.
ci: update actions/github-script to pinned version v7.0.1
Update the GitHub Actions workflow to use a pinned version tag instead of a commit hash for the `actions/github-script` action. This improves maintainability and security by using an official, versioned release.
docs: add security gate check to PR templates and improve scan
Update CONTRIBUTING.md and pull request template to document the new Critical Entry Point Scan requirement. Enhance the security-gate workflow with a warning for large PRs exceeding GitHub API limits and add configuration notes for branch protection.
