feat(widget): autoajustar popups hover al contenido sin scroll

feat(ui): degradado por defecto y hover con opacidad en secundarios

feat(ui): variante destructiva para cuentas y credenciales

feat: canal Quorb Dev instalado desde main

…#84)

* ci: add pull request checks and read-only secrets scanning

* test(signing): make permission checks portable across Windows and POSIX

* fix(ui): preserve logo comment cleanup with parser-compatible regexp

* feat(security): enforce repository policy with exact asset exclusions

* feat(security): validate Semgrep coverage and advisory reports

* feat(security): bind inert Git snapshots to scanner coverage

* feat(security): require bounded parser coverage for each snapshot file

* feat(security): pin offline scanner runtimes and Semgrep entrypoint

* feat(security): provision pinned scanner artifacts with bounded integrity checks

* feat(security): validate offline workflow audit coverage and advisories

* feat(security): prepare pinned offline zizmor bootstrap

* feat(security): complete offline zizmor audit dispatch and behavior coverage

* feat(security): isolate Semgrep execution with trusted container controls

* feat(security): run offline workflow audits through the isolated host

* docs(security): preserve parser investigation evidence and limitations

* docs(security): record reviewed delivery chain and adoption boundaries

* feat(security): wire trusted safety CLI and inactive workflow draft

* fix(security): preserve scanner contracts in Windows tests