[Quality frontier] Maximise security and solo-maintainer context

[edithatogo]

Refined evidence

• Protection/rulesets: no / 0
• Context gaps: pull_request_template, issue_templates
• Setting follow-up: none

Done when

• Add a ruleset blocking force-push/deletion and requiring only stable checks after inventorying bots.
• Keep solo operation: no approval/CODEOWNERS/team gate; retain owner recovery.
• Resolve setting failures; add canonical agent/security/contribution context, one-command validation, and a drift receipt.

Renovate and Codecov rollout

• Grant the hosted Renovate app access to this repository and verify its Dependency Dashboard or first pull request.
• Inherit github>edithatogo/renovate-config; retain any justified repository-specific overrides.
• Remove .github/dependabot.yml only after Renovate is confirmed healthy, avoiding an update-coverage gap or competing bots.
• Produce real test coverage, upload with Codecov OIDC (id-token: write), and verify both the Codecov repository and commit status are active.
• Keep zero mandatory human approvals; use required automated checks as the merge gate.

[edithatogo]

Resolved by #230/#231 and hosted settings. Active ruleset 20171596 blocks deletion/non-fast-forward updates and requires universal automated checks without review/CODEOWNERS/team gates; private vulnerability reporting, secret scanning/push protection, read-only workflow defaults, current templates, and owner recovery are verified. Renovate remains an explicit external gate (installation access could not be verified), so Dependabot stays enabled. Codecov is an evidence-backed exclusion: native LCOV/JSON, enforced thresholds, and CI artifacts provide repository-controlled coverage evidence without an external app.