Securing AI Pull Requests: Building a Deterministic AST Audit Harness in GitHub Actions

Build a deterministic CI/CD audit harness that checks AI coding-agent pull requests for AST prototype pollution, secret leakage, and unsafe egress before merge.