Add offline IBC preflight security guard

[TOPPOOL]

Summary

• add IBC Preflight Guard, a zero-runtime-dependency offline CLI for EVM/IBC testnet configuration
• emit deterministic text, JSON, and SARIF reports without executing config or exposing environment values
• add fail-closed checks for active workflows, addresses, channels, client/proof metadata, CONFIG_PATH boundaries, secp256k1 keys, dummy-proof paths, and risky automation
• add CI for Node 18/20/22 plus security, threat-model, contribution, license-scope, and provenance documentation

Verification

• node --test test/ibc-guard.test.js ??20/20 passing locally
• safe fixture returns exit 0
• current legacy root template intentionally returns exit 1 until placeholder deployment values are replaced
• two independent review passes found no remaining P1/P2 issues

Scope and provenance

This repository originated from the open-ibc Solidity template. The new guard code is MIT-licensed; inherited files that retain UNLICENSED are explicitly excluded in NOTICE. The 2024 Polymer/vIBC workflow is documented as a legacy/testnet compatibility profile, not Polymer's current recommended architecture.