docs(security): strengthen supply chain guidance

shared/rules/security/references/supply-chain.md

@@ -1,6 +1,10 @@
 # Supply-chain security
 
 * Keep dependencies minimal, maintained, and from verified sources; respect lockfiles and review identity and compatibility before adding or upgrading packages.
-* Pin versions where appropriate and remove unused dependencies.
+* Verify package identity, source, maintainer, release history, transitive dependencies, and install-time behavior. Treat typosquats and unexpected ownership changes as risks.
-* Treat plugins, build scripts, CI actions, and generated artifacts as part of the attack surface.
+* Pin or constrain versions according to project policy, commit lockfiles, and remove unused dependencies. Review lockfile changes instead of hand-editing generated entries.
-* Use least privilege for build and deployment identities and never expose credentials in pipelines, logs, or artifacts.
+* Review dependency and build-tool updates for breaking behavior and security advisories; upgrade deliberately and verify the resulting artifact.
+* Treat plugins, build scripts, CI actions, compiler plugins, generated artifacts, and caches as part of the attack surface. Pin CI actions to reviewed immutable revisions where supported.
+* Use least-privilege build and deployment identities. Separate untrusted pull-request jobs from secret-bearing jobs and protect release credentials from untrusted code.
+* Never expose credentials in pipelines, logs, caches, artifacts, command output, or generated packages. Limit secret lifetime and scope.
+* Verify artifact provenance and integrity before release or installation; avoid downloading and executing unverified content dynamically.