Summary

• Add a conservative Destructive Command Guard workflow for repository-wide scan coverage.
• Pin DCG to v0.4.5 and install the Linux binary directly because the published composite action tag/installer currently does not resolve successfully on GitHub Actions.
• Keep permissions read-only and fail only on error-severity findings.

Validation

• YAML parsed with Ruby YAML loader.
• git diff --check passed.
• GitHub Actions DCG job is now running from the direct binary installer.

Current check result

• DCG check passes on the PR branch.