fix(ci): isolate Trunk execution environment

[ss-o]

Summary

• run Trunk with a minimal allowlisted environment and disposable runtime directories
• remove persisted checkout credentials, GitHub token exposure, inline annotations, and checks write permission from the reusable workflow
• add sentinel-based regression tests and safe incident-response guidance

Security behavior

The Trunk process no longer receives GitHub tokens or unrelated inherited environment variables. Credential-bearing token arguments are rejected. Internal failure diagnostics are suppressed and runtime state is deleted. Inline annotations are intentionally removed; pass or fail status and normal lint output remain.

Verification

• sh scripts/test-trunk-safe-check.sh
• bash scripts/test-trunk-safe-ci.sh
• shell syntax and shfmt
• actionlint .github/workflows/trunk.yml .github/workflows/trunk-safe-check-test.yml
• targeted safe Trunk checks with no issues
• 75 agent-policy tests
• 98 Zsh-policy tests
• standalone policy validators
• git diff --check

The explicit eight-file Trunk scan reported no lint issues. Its git-diff-check adapter failed on three locally modified tracked files, while direct isolated git diff --check passed.

Agent handoff

No handoff needed.

Fixes #538