fix: address Codex Security findings

[lperezmo]

Summary

Addresses all three validated findings from Codex Security scan dd7075a0-84c9-4c55-8475-9f72d3ac9e5c:

• make server-local carousel files an explicit PathLike capability and bound local reads
• isolate release building, GitHub asset upload, and PyPI OIDC publication into least-privilege jobs
• stop the showcase from echoing masked PIN and OTP values in plaintext

Root causes

The carousel overloaded ordinary strings as both browser image references and implicit server-file capabilities, then read matching files without a byte limit. The automated release workflow executed build dependencies inside the same job that held PyPI OIDC and repository-write permissions. The PIN showcase reused plaintext round-trip output for credential-like modes.

Impact

String carousel sources are now always browser references. Applications that intentionally inline a local image should pass pathlib.Path or another os.PathLike; local images are limited to 10 MiB each and 20 MiB per render.

The release artifact is built once without elevated permissions, uploaded to GitHub in a contents-write-only job, and published from an OIDC-only job. Masked PIN and OTP demos now expose only completion counts.

Validation

• 10 passed focused security tests
• 56 passed, 64 deselected full non-browser Python suite
• ruff check .
• frontend TypeScript typecheck
• production frontend build and bundle guard
• release-workflow privilege assertions
• git diff --check