Complete first-week repository security and contributor setup #3

Summary

Complete the initial security, contribution, and repository-hygiene setup for the public PiNative repository.

Tasks

• Add SECURITY.md with private vulnerability-reporting instructions.
• Enable GitHub private vulnerability reporting.
• Add CONTRIBUTING.md with project-specific setup, testing, and contribution guidance.
• Add .github/dependabot.yml for GitHub Actions dependency updates.
• Enable secret scanning.
• Enable secret scanning push protection.
• Confirm the GitHub wiki is disabled.
• Review existing public issues for prompts, local paths, API responses, credentials, or other sensitive information. Issues Complete first-week repository security and contributor setup #3, Add Queue as follow-up for active chats #5, and Unify Escape and Stop interruption with persistent transcript status #6 were reviewed; no sensitive information was found.
• Confirm that private research, named design references, screenshots, and generated reports remain outside the repository. The tracked README screenshot is an intentional public product asset.
• Decide whether docs/code-architecture-walkthrough.html is intentional durable documentation or generated output that should live elsewhere. It is intentional, versioned, Markdown-backed documentation and should remain tracked.

Current state

• Dependabot vulnerability alerts and security updates are enabled.
• Secret scanning and push protection are enabled.
• Private vulnerability reporting is enabled.
• The GitHub wiki is disabled.
• research/ is excluded by .gitignore; no private research or evidence artifacts are tracked.
• Tracked app icons and the README screenshot are intentional product assets.
• No personal filesystem paths were found; existing /Users/me and /Users/example paths are test/example values.
• The architecture walkthrough HTML is a deliberate durable documentation artifact generated from tracked Markdown sources.

Completion criteria

The public repository provides a private security-reporting path, basic contributor guidance, automated dependency-update coverage, enabled GitHub secret protections where available, and a documented decision about generated repository content.