[Quality frontier] Maximise security and solo-maintainer context

[edithatogo]

Refined evidence

• Protection/rulesets: no / 0
• Context gaps: pull_request_template, issue_templates
• Setting follow-up: none

Done when

• Add a ruleset blocking force-push/deletion and requiring only stable checks after inventorying bots.
• Keep solo operation: no approval/CODEOWNERS/team gate; retain owner recovery.
• Resolve setting failures; add canonical agent/security/contribution context, one-command validation, and a drift receipt.

Renovate and Codecov rollout

• Grant the hosted Renovate app access to this repository and verify its Dependency Dashboard or first pull request.
• Inherit github>edithatogo/renovate-config; retain any justified repository-specific overrides.
• Remove .github/dependabot.yml only after Renovate is confirmed healthy, avoiding an update-coverage gap or competing bots.
• Produce real test coverage, upload with Codecov OIDC (id-token: write), and verify both the Codecov repository and commit status are active.
• Keep zero mandatory human approvals; use required automated checks as the merge gate.