Add native Swift PR gate and preserve Go source scanning

[hideouts-io]

Adds a Swift application build alongside the existing Go formatting, vet, race, shuffled-test, build, and CLI smoke gates. A CI-only preparation script validates narrow lock fields, exact upstream archive URLs, archive/executable SHA-256 values, and the osquery signature before bundling the existing pinned tools. No scanner or vulnerability database update is run.

Adds explicit Go, Swift, and Actions CodeQL analysis with read-only extraction and isolated SARIF uploads, repository instructions, and weekly Go/Actions updates. The local native Swift build and exact tool verification passed. GitHub must confirm successful analysis of every intended language at this PR revision; Go tests and native builds establish no live host-scan or privileged-helper behavior.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.