Align provider maxRetries default with pi (0), treat maxRetryDelayMs 0 as no cap, keep per-attempt timeout through stream reads, and fix gitleaks test fixtures.
Add comprehensive security scanning to CI/CD pipeline including CodeQL, Gitleaks, Semgrep custom rules, dependency review, and lifecycle script checks