Harden security boundaries and suspend parallel campaigns pending isolation - #68

Summary

• Harden local workspace teardown and backup safeguards across Bash and PowerShell.
• Strengthen learning package, secret scanning, and pre-push validation.
• Suspend productive parallel campaigns until worker authority isolation is available.
• Refresh regression coverage, security evidence, script reference, and project statistics.

Validation

• Final Codex Security Standard scan on af10b12: zero confirmed findings with documented partial repository coverage.
• Focused Security Diff Scan of the final hook patch: zero confirmed findings; its working-tree inventory limitation is recorded in the private scan.
• Four isolated pre-push regressions passed; the broader security boundary suite passed 48 tests earlier in this branch.
• Homogeneity 30/30; generated statistics and script reference current; PowerShell analyzer passed 124 repository-owned files.
• Local pre-push Gitleaks scanned the outgoing commit range and reported no secret.

Documentation Impact: UpdateRequired; evidence is in the repository's AEPS security-remediation receipt.