codex(v1 base): packaged Python reference (X25519/HKDF/ChaCha20-Poly1305), enforceable crypto policy, canonical receipts, Makefile, CODEOWNERS, and supply-chain guardians #4

	name: CI (lint, typecheck, tests, bandit)
	on:
	push:
	branches: [ "main" ]
	paths: ["src/","tests/","pyproject.toml","Makefile",".github/workflows/ci.yml","policy/**"]
	pull_request:
	branches: [ "main" ]
	paths: ["src/","tests/","pyproject.toml","Makefile","policy/**"]
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true
	permissions:
	contents: read
	jobs:
	build:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: "3.11"
	- name: Install deps
	run: \|
	python -m pip install --upgrade pip
	pip install -e ".[dev]"
	- name: Lint (ruff)
	run: ruff check src tests
	- name: Typecheck (mypy)
	run: mypy src
	- name: Unit tests
	run: pytest -q
	- name: Security (bandit)
	run: bandit -r src -q -c pyproject.toml \|\| true

Provide feedback