Add CI and repo security settings before going public

Summary

There is no .github/ directory. npm test and npm run check never run on a pull request, and main has no branch protection.

For a project whose entire value proposition is "this is the safe way to let an agent touch your Meetup account", landing changes with no automated gate is the wrong signal to prospective users.

Suggested additions

• A workflow running npm ci, npm run check and npm test on pull requests and on pushes to main
• Branch protection on main requiring that workflow to pass
• CodeQL, or at minimum GitHub's secret scanning and push protection, both free on public repos
• Dependabot for the three runtime dependencies
• A SECURITY.md with a disclosure contact

Note

Dependency hygiene is already good and worth preserving: all dependencies are pinned to exact versions and npm audit reports zero advisories.

Start by reviewing the repository scripts behind npm test and npm run check, then inspect the existing repository settings and the proposed .github/ additions. Add the pull-request and main-push workflow, branch protection, security scanning, Dependabot configuration, and SECURITY.md with a disclosure contact. Done means the checks run successfully and the requested public-repository protections are configured.