ci/security/test: automated audit fixes for HkEquityStrategies

[Pigbibi]

Summary

• redact secret-like findings in the Codex review gate instead of echoing matched values
• add regression coverage for the redaction behavior
• migrate deprecated Ruff top-level ignore settings
• add pip check and package build to CI

Problems found

• scripts/gate_codex_app_review.py reported matched secret-like fragments directly in violation messages
• Ruff emitted a deprecation warning for top-level ignore
• CI did not verify dependency health or package build

Fixes applied

• normalize secret field names and emit <redacted> in gate findings
• add tests/test_gate_codex_app_review.py
• move ignore to [tool.ruff.lint]
• add python -m pip check and python -m build to CI

Security impact

• reduces risk of secret-like values leaking into CI logs or gate output
• no runtime strategy behavior, credentials, or platform contracts changed

Architecture impact

• low risk; audit gate output and CI verification only

Tests run

• .venv-audit/bin/python -m pip check
• .venv-audit/bin/ruff check .
• .venv-audit/bin/python -m pytest -q tests/test_gate_codex_app_review.py
• .venv-audit/bin/python -m pytest -q
• .venv-audit/bin/python -m build
• actionlint
• git diff --check

Failed or skipped checks with reasons

• none

Deployment notes

• no deployment required

Rollback plan

• revert commit 08a7a29

Manual follow-up checklist

• confirm PR checks pass
• merge after branch protection requirements are satisfied