[yeongseon]

Summary

Complete the remaining make check contract from #811 without duplicating offline gates.

Changes

• check runs lint (including format and mypy), the existing full Bandit scope, and workflow lints.
• check-all calls check and test, retaining every prior gate exactly once.
• Contract tests cover both aggregates and contributor docs describe the deliberate command change.

Validation

• Regression first: check omitted all four expected security/workflow commands; check-all already passed.
• make check-all passed: 1651 passed, 30 skipped, 22 deselected, 5 warnings in 27.25s; coverage 95.25%.
• make docs and make build passed.
• GitHub CI pending.

Related Issues

Refs #811

This focused follow-up addresses the static-check acceptance item; it does not re-certify every historical item in the closed umbrella issue.

Merge authorized by the maintainer’s explicit instruction.