Repo hardening: settings-based hygiene checks (hangar policy)

Follow-up to #70, which fixed all **file-based** repository hygiene gaps flagged by a [hangar](https://github.com/get2knowio/hangar) policy scan. The remaining failures are **settings-based** — they can't be fixed by a PR and must be toggled in GitHub repo/org settings.

After #70 this repo sits at **13/23** hangar checks passing. Completing the items below (plus the optional CodeQL workflow) closes the rest.

## Manual steps (priority order)

- [x] **Secret scanning + push protection** — Settings → Code security → enable Secret scanning **and** Push protection. _(free, one toggle, high value)_
- [x] **Default workflow token = read-only** — Settings → Actions → General → Workflow permissions → "Read repository contents and packages permissions". Workflows that need write already declare it per-job (e.g. `release.yml` sets `contents: write`).
- [x] **Branch protection / ruleset on `main`** — currently neither a branch protection rule nor a ruleset exists. Add a ruleset requiring PRs + passing CI before merge.
- [x] **Org 2FA enforcement** — org-wide setting for `get2knowio` (Organization settings → Authentication security → Require two-factor authentication). Affects all repos, not just this one.

## Optional (can be a PR instead of a setting)

- [x] **CodeQL code scanning** — either enable GitHub's default setup (Settings → Code security → Code scanning), or add a `.github/workflows/codeql.yml`. Happy to open that PR on request.

## Policy-mismatch items (not planned)

These hangar checks fail only because remo uses different tooling than the policy detects; no action intended unless we decide to adopt them:

- **release-please configured** — remo uses tag-triggered `action-gh-release` + PyPI publish instead.
- **Conventional commits enforced** — commits already follow the convention, but no commitlint/semantic-PR-title workflow enforces it.
- **CHANGELOG automated** — no `CHANGELOG.md`; release notes live in GitHub Releases.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Review the GitHub repository and organization settings named in the issue, including code security, Actions workflow permissions, main branch rulesets, and organization 2FA. Run or review the hangar policy scan after verification; done means the listed settings are enabled, optional CodeQL is configured if chosen, and only the documented policy mismatches remain.

Written by the indexing model from the issue text.