security(ci): add a scheduled OSV/SCA scan for unchanged main

[qnbs]

Context\n\nThe enforced OSV scan currently runs from the CI workflow on pushes, tags, and pull requests. A vulnerability disclosed after the last code change can therefore remain undetected until another event occurs.\n\n## Acceptance criteria\n\n- Add a daily or weekly scheduled scan, preferably isolated from expensive build/test jobs.\n- Scan pnpm-lock.yaml, src-tauri/Cargo.lock, and crates/Cargo.lock with the same deterministic policy as CI.\n- Use least-privilege permissions, concurrency cancellation, and no secret exposure.\n- Define alert/failure and triage semantics for an unchanged main branch.\n- Keep the existing PR/main OSV gate authoritative; do not replace it with an advisory scheduled job.

[qnbs]

Implemented and merged in PR #454 (87764570).

Evidence:

• Added .github/workflows/security-scheduled.yml with a daily cron and workflow_dispatch trigger.
• Scans pnpm-lock.yaml, src-tauri/Cargo.lock, and crates/Cargo.lock with the existing pinned OSV scanner and src-tauri/osv-scanner.toml.
• Uses contents: read, cancellation concurrency, an actionable $GITHUB_STEP_SUMMARY, and fail-closed enforcement for scanner failure or a missing/empty report.
• The container/runner report-path mismatch identified during Graphite review was fixed in 10c8cd41 and included in the merge.
• Policy tests cover the active workflow job/steps and the scheduled/manual/security contracts.

The existing PR/main security job remains the authoritative event-driven gate; this workflow closes the unchanged-main quiet-repository blind spot without scheduling the full CI matrix.