docs(supply-chain): add developer workstation security guidance

[s1ns3nz0]

What does this PR change?

Adds a developer-workstation security guide that treats repositories, IDE configuration, AI tools, MCP servers, dependencies, and model artifacts as software supply-chain inputs before execution.

The guide covers:

• governance of external development tools through request, risk review, approval, managed deployment, monitoring, reassessment, and removal
• managed allowlists, time-limited exceptions, and inspectable compliance evidence
• pre-execution screening and confined evaluation environments
• endpoint baselines, detection, incident response, and an interactive checklist
• dated, directly sourced examples covering repository automation, extension publishing, MCP packages, dependency compromise, and AI package hallucination

It also links the guidance from Supply Chain, AI Security, DevSecOps IDE, Endpoint Security, and DPRK IT Worker pages, and registers the author and navigation entry.

Type of change

• New content
• Edit to existing content
• Outline / structure change
• Typo or formatting fix
• Tooling / config

If applicable

• Editing existing content: tagged the current contributors from the attribution list
• Framework has a steward: asked them to review
• Outline change: updated vocs.config.ts with the dev: true parameter
• Want community feedback: shared this PR in our Discord

Verification

• pnpm exec just lint
• pnpm run docs:build
• CSpell and targeted supply-chain validation
• Interactive checklist and rendered links verified locally
• All contribution commits are signed

[github-actions]

Sidebar Configuration Reminder

This PR includes added, renamed, or removed documentation files:

• docs/pages/supply-chain/developer-workstation-security.mdx (added)

Please ensure that:

• The sidebar in vocs.config.ts has been updated to include these files
• New content has the dev: true parameter so it's marked as under development
• Sidebar links match the file paths - use the preview deployment to verify

See Contributing Guide – Sidebar & Navigation for more details.

---

_{This is an automated reminder. If this PR doesn't need sidebar changes, you can ignore this message.}

[s1ns3nz0]

Small self-review while this waits: applied RFC modality to the baseline checklist in 97f5a24, matching the normative modality rules in docs/pages/contribute/style-and-terminology.mdx.

Items required for the control to hold take must; the four with valid organizational exceptions — review cadence, install-script blocking, obfuscation detection, and endpoint management coverage — take should.

I also checked this page against the second-person feedback from #592 and it was already clean, so no changes needed there.

validate:content 7 passed / 0 failed, markdownlint and cspell clean, docs:build passes. Branch is rebased on current develop and conflict-free.