security(repo): enforce secret protection and required security checks

[pierrick-fonquerne]

Goal

Back the repository-level security workflows with GitHub settings that cannot be bypassed accidentally.

Acceptance criteria

• Secret scanning and push protection are enabled for the repository.
• Push-protection bypass requires a reason and an auditable review according to the organization policy.
• The default GITHUB_TOKEN permission is read-only.
• Fork pull requests never receive write tokens or Actions secrets.
• First-time contributor approval policy limits compute abuse without granting the workflow additional privileges.
• Repository rulesets require the stable CI and security check names before merging to main.
• Direct pushes and force pushes to main are restricted according to the maintainer policy.
• Release environments require review before crates.io or registry credentials become available.
• Code scanning and dependency alerts have documented ownership and response expectations.
• The settings are recorded in an operator checklist or policy-as-code mechanism so drift can be detected.