security: prepare OpenSSF Silver release

[cdeust]

Summary

• display the official OpenSSF Best Practices Passing badge and synchronize the full Silver evidence dossier
• name and enforce the Python and shell coding standards with hash-locked Ruff plus the existing checksum-verified ShellCheck gate
• prepare the repository release v2.2.0, with component versions context-guard 2.0.1, refine-gate 2.1.0, and statusline 2.1.2

Silver status

Project 13938 is officially Passing. After this PR lands, every Silver MUST criterion is evidenced except signed_releases: the existing OIDC release workflow must still be exercised by publishing tag v2.2.0 and independently verifying its Sigstore attestations. The dossier keeps that criterion Unmet until the public artifact exists.

The dossier also keeps these non-blocking SHOULD/SUGGESTED criteria honest: one-person bus factor, no DCO/CLA, incomplete runtime localization, fixed SHA-256 manifest algorithm, unsigned historical tags, and no generic native/web hardening claim.

Verification

Fresh Python 3.11 environment installed exclusively from requirements-dev.lock with --require-hashes:

• ruff check plugins tests — passed
• coverage run -m pytest -q && coverage combine && coverage report — 50 passed; 715 statements, 45 missed, 94%
• bash tests/statusline/test_heat_rgb.sh — 22 passed
• bash tests/statusline/test_fit_and_pace.sh — 53 passed
• release bundle build and verifier — passed
• every project JSON document through python -m json.tool — passed
• lock regeneration — byte-identical apart from the generated output-path comment
• git diff --check — passed

Release handoff

This PR does not create a tag or public release. After merge, publish v2.2.0; the existing release workflow will test, build, verify, attest, and publish the source bundle, executable manifest, CycloneDX SBOM, and checksums. Verify with the exact commands in SECURITY.md before changing signed_releases to Met in OpenSSF.