ci: harden flaky dagger job; docs: document Phase 1 project scores

CI: the dagger job repeatedly failed (and once hung 10 min) pulling the engine
image from registry.dagger.io. Pin the dagger CLI to 0.21.7 (matching dagger-io
and the SDK's CLI_VERSION so the engine tag is deterministic), pre-pull
registry.dagger.io/engine:v0.21.7 with a dependency-free retry loop (5 attempts,
90s/pull, 20s backoff) so the action's `docker image inspect` finds it cached and
skips its own flaky pull, and add a 20-minute job timeout so a stalled pull can
no longer hang the run. The canonical `checks` job is unchanged.

Docs: add a "Project scores and central CWE policy" README section documenting
the implemented Phase 1 — central verycode CWE policy, policy-governed severity
(one CWE = one severity), the fail-loud invariant, the 0-100 project score and
two-condition advisory-first gate, the score.json/manifest artifacts, and the
CWE-120 -> CWE-121 remap.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

.github/workflows/ci.yml

@@ -28,13 +28,44 @@ jobs:
 
   dagger:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      # Must match dagger-io (0.21.7) and dagger/_engine/_version.py CLI_VERSION
+      # so the engine image tag is deterministic. The dagger-for-github action
+      # runs `docker image inspect registry.dagger.io/engine:v${DAGGER_VERSION}`
+      # and skips its own (flaky) pull when the image is already in the local
+      # docker cache, so the pinned tag below MUST equal the action's version.
+      DAGGER_VERSION: 0.21.7
     steps:
       - uses: actions/checkout@v5
       - uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
+      - name: Pre-pull dagger engine image (retry transient registry timeouts)
+        timeout-minutes: 8
+        run: |
+          set -euo pipefail
+          image="registry.dagger.io/engine:v${DAGGER_VERSION}"
+          attempts=5
+          for i in $(seq 1 "${attempts}"); do
+            echo "::group::Pull attempt ${i}/${attempts}: ${image}"
+            if timeout 90 docker pull "${image}"; then
+              echo "Pulled ${image} on attempt ${i}"
+              docker image inspect "${image}" >/dev/null
+              echo "::endgroup::"
+              exit 0
+            fi
+            echo "Pull attempt ${i} failed."
+            echo "::endgroup::"
+            if [ "${i}" -lt "${attempts}" ]; then
+              echo "Retrying in 20s..."
+              sleep 20
+            fi
+          done
+          echo "All ${attempts} pull attempts failed for ${image}" >&2
+          exit 1
       - uses: dagger/dagger-for-github@v7
         with:
-          version: latest
+          version: 0.21.7
           verb: run
           args: uv run python dagger/ci.py