security-scan: make exact-head checkout initialize `main` explicitly

[seonghobae]

Problem

The organization-required Security Scan still emits Git's default-initial-branch warning from its exact-head actions/checkout steps on hosted Ubuntu 24.04 / Git 2.55:

hint: Using 'master' as the name for the initial branch.
hint: will change to "main" in Git 3.0.

Fresh downstream evidence is LifeOS PR #247 exact 48087da1d1d5031374eacc12228d1a96f55359c0, Security Scan run 34643498057, Trivy job 103408671264. The job's Checkout exact Trivy head step succeeds, but checkout initializes the temporary repository with Git's implicit default branch before fetching the requested exact SHA.

This is no longer a LifeOS-local workflow defect. LifeOS #276 already repaired all six repository-owned persistent workflows by passing process-local Git configuration into each checkout step. A fresh hosted probe established that:

GIT_CONFIG_COUNT=1
GIT_CONFIG_KEY_0=init.defaultBranch
GIT_CONFIG_VALUE_0=main

causes the checkout-internal git init to create main directly and removes both the legacy master hint and Git 3.0 warning without suppressing stderr. Exact LifeOS candidate 2a82ce060ee9c8b88923b1613b0e5b7af4525ee3 / run 34637354400 and writer run 34637594717 verified that repair across 15 checkout steps / 6 persistent workflows.

The remaining warning comes from the central required workflow. Current .github/workflows/security-scan.yml has exact-head checkout steps such as Checkout exact Trivy head using the pinned Node-24 actions/checkout, and tests/test_required_workflow_queue_contract.py explicitly covers the Dependency Review, Trivy, and Scorecard checkout identities, but the central checkout steps do not yet carry explicit initial-branch authority.

Acceptance

• Add process-local init.defaultBranch=main authority to every central Security Scan checkout that performs an exact-head repository initialization, including Dependency Review, Trivy, Scorecard, and any equivalent checkout sites found by the owner sweep.
• Extend the permanent central workflow contract so a checkout cannot silently regress to implicit Git default-branch initialization.
• Preserve exact-SHA checkout, existing repository/ref bindings, persist-credentials semantics, permissions, scanner gating, SARIF behavior, and fail-closed Dependency Review behavior.
• Do not hide the warning with advice.defaultBranchName=false, stderr redirection/filtering, || true, or generic warning suppression.
• Prove the repair on a fresh unchanged-head downstream consumer run where the central required Security Scan executes and the Git default-branch warning is absent while the same security jobs retain their prior semantics.
• Integrate through normal protected-branch policy; downstream repositories should consume the central repair rather than copy this workflow source.

Refs ContextualWisdomLab/life-os#277, ContextualWisdomLab/life-os#276, ContextualWisdomLab/life-os#247.