fix(security): update docs after security hardening — repo is public, branch protection enabled, secret scanning on

[qmarcelle]

Summary

Security hardening was applied via the GitHub API on 2026-07-28. This PR updates the committed documentation to match the actual state.

Changes

• SECURITY.md: Removed the maintainer note about private vulnerability reporting not being live. It is now enabled.
• docs/repository-settings.md: Updated to reflect:
  • Visibility is now public (was private)
  • Branch protection is enabled on main (was none)
  • Secret scanning + push protection are enabled
  • Private vulnerability reporting is enabled
  • Replaced the "what to enable when public" checklist with the current measured state
  • Updated the branch protection section with the actual configuration

Verification

gh api repos/workspacejson/standard/branches/main/protection --jq '{
  enforce_admins: .enforce_admins.enabled,
  pr_reviews: .required_pull_request_reviews.required_approving_review_count,
  conv_resolution: .required_conversation_resolution.enabled,
  force_pushes: .allow_force_pushes.enabled,
  deletions: .allow_deletions.enabled,
  status_checks: [.required_status_checks.contexts[]]
}'

Returns:

{"conv_resolution":true,"deletions":false,"enforce_admins":true,"force_pushes":false,"pr_reviews":1,"status_checks":["test (20)","test (22)","Four-path producer conformance"]}

Notes

These are documentation-only changes — the actual settings were applied via the GitHub API. The docs need to match so that drift is detectable.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.