[pjhartlieb]

Adds dev-security.yml, which calls release-workflows dev-security.yml at v1.1.0 (pinned by commit SHA). On every pull request it runs dependency review and the workflow lint (actionlint, zizmor), the security checks publishing policy rule 3 requires on dev. Once this merges, the dev ruleset requires dev-security / dependency-review and dev-security / workflow-lint.

It also fixes what zizmor reports in the existing workflows, so the new check starts green:

• cla.yml: both triggers marked as reviewed. cla-reusable.yml never checks out pull request code.
• publish.yml: the same-repository workflow calls marked as reviewed.
• benchmark.yml (where present): checkouts no longer persist credentials.
• dependabot.yml: version updates wait 7 days after a release is published (cooldown), so a compromised release has time to be caught first. Security updates are not delayed.

Locally: actionlint 1.7.12 clean, zizmor 1.30.1 (the version the check runs) no findings across the repository.

[github-actions]

DNS Resolver Benchmark

this PR @ a4a45b0 against dev @ ab2568b, base → head, median of 3 interleaved rounds. Bold is significant across all 56 comparisons (Benjamini-Hochberg at 1%); the rest is noise.

regime	qps	unanswered	p99	attempts/query
ceiling/1-resolver	20,546 → 20,128 (-2.0%)	0.00% → 0.00%	0.971s → 0.991s (+2.1%)	1.00 → 1.00
pool/32-resolvers	20,337 → 20,338 (+0.0%)	0.00% → 0.00%	0.981s → 0.980s (-0.0%)	1.00 → 1.00
pool/32-persistent	21,787 → 21,892 (+0.5%)	0.00% → 0.00%	0.915s → 0.911s (-0.5%)	1.00 → 1.00
impaired/10%-loss	219 → 219 (-0.0%)	0.00% → 0.00%	7.313s → 7.314s (+0.0%)	1.11 → 1.11
impaired/20%-REFUSED	2,669 → 2,697 (+1.0%)	0.00% → 0.00%	0.749s → 0.741s (-1.0%)	1.24 → 1.24
impaired/50ms-latency	618 → 617 (-0.2%)	0.00% → 0.00%	3.234s → 3.239s (+0.2%)	1.00 → 1.00
impaired/20%-then-2.5%-dead-names	263 → 233 (-12%)	5.43% → 5.43%	10.223s → 11.125s (+8.8%)	1.05 → 1.05

All metrics

regime	p50	p100	sockets	conntrack
ceiling/1-resolver	0.529s → 0.535s (+1.2%)	0.973s → 0.993s (+2.1%)	42 → 42 (+0.0%)	14,614 → 12,688 (-13%)
pool/32-resolvers	0.529s → 0.530s (+0.2%)	0.983s → 0.983s (-0.0%)	73 → 74 (+1.4%)	19,217 → 19,399 (+0.9%)
pool/32-persistent	0.491s → 0.491s (-0.0%)	0.918s → 0.913s (-0.5%)	42 → 42 (+0.0%)	29 → 30 (+3.4%)
impaired/10%-loss	3.316s → 3.315s (-0.0%)	9.128s → 9.128s (+0.0%)	46 → 46 (+0.0%)	2,105 → 2,090 (-0.7%)
impaired/20%-REFUSED	0.419s → 0.417s (-0.4%)	0.749s → 0.741s (-1.0%)	46 → 46 (+0.0%)	2,203 → 2,173 (-1.4%)
impaired/50ms-latency	1.845s → 1.848s (+0.2%)	3.234s → 3.239s (+0.2%)	46 → 46 (+0.0%)	865 → 636 (-26%)
impaired/20%-then-2.5%-dead-names	3.762s → 3.731s (-0.8%)	11.396s → 12.878s (+13%)	39 → 39 (+0.0%)	2,971 → 2,950 (-0.7%)