Add dependency updates and stage main protection with a release bypass

[itsjling]

Main currently has no PR/check requirement, and the release workflow uses a default token that cannot bypass one. This adds weekly Dependabot updates and a dedicated release push identity so main can require PRs without introducing release PRs.

• Configure npm/pnpm and GitHub Actions updates for Mondays at 09:00 UTC, capped at five version-update PRs per ecosystem. Automatic merging stays disabled.
• Require the npm-publish environment's SSH deploy key for release finalization. The default token now has read-only contents access; npm publishing still uses OIDC. Preparation never receives the key.
• Check in the intended rules: zero required approving reviews, resolved threads, an up-to-date branch, and five existing PR checks. Separate history rules prevent the release key from force-pushing or deleting main. Admins retain an emergency bypass with documented recording and recovery steps.

Live setup is recorded in issue #129. Alerts, security updates, and the dependency graph are enabled. The release key is installed in the existing main-only environment, and main-history is active.

Post-merge rollout remains required. main-review is staged as disabled to preserve the current release workflow until this change reaches main. After merge, apply the activation command in docs/repository-security.md, then confirm both Dependabot ecosystem runs. Keep #129 open until those checks pass. Scorecard results are unavailable, with monitoring tracked in #127.

Verification:

• corepack enable and corepack pnpm run setup bootstrapped this worktree from its lockfile.
• corepack pnpm run check passed, including lint, unit/integration tests, docs checks/build, and packed-package smoke tests.
• corepack pnpm test passed, including coverage, browser, and platform lanes.
• The release workflow contract test failed before the change and passed afterward. The YAML parses with both agreed schedules and limits.
• On a disposable GitHub branch with equivalent active rules, a normal direct update was rejected, the release key's fast-forward push succeeded, and its force push and deletion were rejected. Temporary refs/rules and local private-key copies were removed. No production release was dispatched.

The first full test attempt overlapped the product gate and hit a timing-sensitive review-chat timeout. That test passed in isolation and the full command passed when rerun separately.

The release workflow automation diff was reviewed. All PR CI checks passed on fc134944a990595d2095346dba3a31499b77ab37. Codex review found no major issues on that commit. The final watcher check reported a clean merge state and zero unresolved threads. No application UI changed, so UI capture is not applicable.

Refs #129.

[itsjling]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-06T00:24:19.383009Z	fc13494	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: fc134944a9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".