fix(ci): restore refactor workflow parity

[aidandaly24]

Description

Restore workflow parity on the refactor branch while keeping its Bun-based CI architecture.

• Add branch-native CodeQL, PR Size and Title, Claude Security Review, and AgentCore Harness Review workflows.
• Move static checks into a dedicated Quality and Safety Checks orchestrator rather than duplicating them under CI.
• Add Secretlint to the existing lint, format, typecheck, and audit checks.
• Add the repaired Harness reviewer assets so refactor remains self-contained when it becomes the default branch.
• Format two files already present on the refreshed refactor base that the restored formatting check would otherwise reject.

The current default branch must also recognize refactor for pull_request_target workflows. That change is in #2002.

Related Issue

N/A - workflow parity for the unreleased refactor branch.

Documentation PR

N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

How have you tested the change?

• bun test completed with 1,411 passing tests; seven src/io/exec subprocess failures and two OpenTelemetry local-server bind failures reproduce unchanged on untouched current origin/refactor in this host environment
• I ran bun run typecheck
• I ran bun run lint:check
• If I modified src/assets/, I ran the snapshot update command and committed the updated snapshots

Additional verification:

• bun install --frozen-lockfile
• bun run format:check
• bun run secrets:check
• bun audit
• bun run build
• python -m unittest test_harness_review.py
• python -m py_compile harness_review.py test_harness_review.py
• Parsed every workflow YAML file

Checklist

• I have read the CONTRIBUTING document
• I have added necessary tests that prove the fix is effective
• I have updated the documentation accordingly
• No new example is needed for this CI-only change
• My changes generate no new warnings
• Dependent change fix(ci): restore refactor PR automation #2002 must merge for default-branch pull_request_target filters

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.01%. Comparing base (01eb60b) to head (2f2ad9a).

Additional details and impacted files

@@            Coverage Diff            @@
##           refactor    #2003   +/-   ##
=========================================
  Coverage     97.01%   97.01%           
=========================================
  Files           368      368           
  Lines         21630    21630           
=========================================
  Hits          20984    20984           
  Misses          646      646           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[aidandaly24]

Closing as superseded. Shared Security and Harness mechanics belong in aws/agentcore-devx-devtools; a replacement refactor PR will retain only repository-specific CodeQL, Quality/Safety, prompts, and thin callers.