Enable and operationalize GitHub secret scanning and push protection

### Description

Protect the repository from accidentally committed credentials by verifying and enabling GitHub secret scanning and push protection where available, then defining a clear response process for alerts.

### Action Items

- [ ] Audit the repository and organization security settings to determine the current availability and state of secret scanning, push protection, validity checks, and partner-pattern coverage.
- [ ] Enable GitHub secret scanning and push protection for supported secret patterns, subject to organization policy and maintainer approval.
- [ ] Verify that alerts are visible to the appropriate maintainers and that notification settings support a timely response.
- [ ] Define a documented triage process: validate exposure, revoke/rotate the secret, remove it from current code and relevant history when appropriate, and close or dismiss the alert with rationale.
- [ ] Document an approved local-development approach for secrets, including environment files, example/config templates, and keeping real credentials out of committed files.
- [ ] Add any necessary ignore/example-file guidance without adding real secrets or weakening detection.
- [ ] Test the configuration safely using GitHub's supported test approach or a non-sensitive test pattern; do not commit a real credential.
- [ ] Document ownership, alert-routing expectations, and the contributor-facing remediation guidance.

### Additional Information

Related work: #741 (CodeQL) and #743 (Dependabot). Secret scanning is complementary: it detects exposed credentials, while CodeQL analyzes code and Dependabot monitors dependencies.

Do not automatically bypass push protection or add broad allowlists. Any exception should be narrowly scoped, justified, and documented.

Start by auditing the repository and organization GitHub security settings, including secret scanning, push protection, validity checks, partner-pattern coverage, alerts, and notifications. Review related work in issues #741 and #743. Done means supported protections are enabled with maintainer approval, safe testing is complete, and the triage, local-secrets, ownership, routing, and remediation guidance is documented without real secrets or broad bypasses.

Written by the indexing model from the issue text.