## What

Adds `step-security/harden-runner` as the first step of the Linux
Namespace
jobs in `run_tests.yml`, running in audit mode (`egress-policy: audit`).
In
audit mode it records each job's outbound network connections and blocks
nothing — there is no change to what the jobs can do.

Pinned to
`step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411`
(v2.19.4); v2.19.0+ is required for Namespace runners. Each run links to
its
per-run insights from the job log.

## Scope

- **Included:** the 13 Linux Namespace jobs in `run_tests.yml`.
- **macOS excluded:** harden-runner's monitoring agent is Linux-only on
  Namespace runners — it skips install on Namespace macOS, so it adds no
  coverage there and its cleanup step fails.
- **Also not included:** the Windows jobs, the `tests_pass` gate (no
checkout,
no egress to record), and the `extension_tests` reusable-workflow call.
- The shared job builders (`clippy`, `run_platform_tests`,
`check_scripts`,
`orchestrate`) are reused by other workflows, so they take a flag to add
the
step only in the `run_tests` context. `release.yml`,
`release_nightly.yml`,
  and `extension_tests.yml` are unchanged.

## How

Edits the workflow DSL under `tooling/xtask/src/tasks/workflows/`; the
YAML is
regenerated with `cargo xtask workflows`.

## Verification

- `cargo xtask workflows` is idempotent — the `check_scripts` parity
check passes.
- `cargo fmt --check` and `actionlint` clean; `zizmor` shows no new
findings vs. baseline.

Release Notes:
- N/A

---------

Co-authored-by: zed-zippy[bot] <234243425+zed-zippy[bot]@users.noreply.github.com>