test(ci): align release governance tests with central Security Scan (#926)

[seonghobae]

Problem

The backend (Python 3.14) CI job fails on develop (and therefore on every feature PR that inherits it — #964/#965/#970/#971/#972) with two failures in backend/tests/test_release_governance.py:

FAILED test_stepsecurity_remediation_adds_pinned_audit_hardening
  AssertionError: required governance artifact is missing: .github/workflows/dependency-review.yml
FAILED test_required_code_scanning_workflows_upload_scorecard_and_trivy_sarif
  assert 'pull_request:' in "<scorecard.yml contents>"

Root cause

This is stale test drift, not a Python 3.14 incompatibility (the same assertions fail on any interpreter). Commit 9db32d04 (#926, "stop duplicating central Security Scan on PRs") intentionally:

• deleted .github/workflows/dependency-review.yml, and
• removed the pull_request: trigger from scorecard.yml and trivy.yml,

because the org-wide central Security Scan already runs dependency-review, scorecard, and trivy-fs on every PR. The per-repo workflows now provide default-branch coverage via push/schedule only. The governance suite was not updated in that PR, so two assertions still expect the pre-#926 state.

Fix

Realign the governance tests with the intended architecture:

• Drop the deleted dependency-review.yml from the hardened-workflow list and remove its dependency-review-action assertion.
• Assert pull_request: is absent (not present) for scorecard/trivy, while keeping the push: / - develop / - master default-branch coverage checks.

No governance coverage is lost — the central Security Scan remains the PR gate. Full backend suite verified locally with the CI env (PYTHONWARNINGS=error, DISABLE_BACKGROUND_WORKERS=1): 1139 passed, 22 skipped (previously 1137 passed, 2 failed).

🤖 Generated with Claude Code

[seonghobae]

Superseded by #968 (functionally identical test-only realignment to the post-#926 central-Security-Scan architecture; #968's coverage-evidence + backend checks are already green). Closing this duplicate to reduce clutter — merge #968 to clear coverage-evidence on #964/#970/#971/#972/#973.