chore: establish GitHub governance and security routing

.github/CODEOWNERS

@@ -0,0 +1,8 @@
+# Default review routing. Enforcement is controlled by repository rulesets.
+* @hexanomicon/core
+
+# Security, workflow, architecture, and delivery truth deserve an explicit route.
+/.github/ @hexanomicon/core
+/SECURITY.md @hexanomicon/core
+/docs/adr/ @hexanomicon/core
+/docs/state-of-the-work.md @hexanomicon/core

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,9 @@
+blank_issues_enabled: true
+
+contact_links:
+  - name: Questions and design discussion
+    url: https://github.com/hexanomicon/lychd/discussions
+    about: Ask usage questions or explore a design before it becomes bounded implementation work.
+  - name: Security vulnerability
+    url: https://github.com/hexanomicon/lychd/security/policy
+    about: Do not disclose a suspected vulnerability in a public issue.

.github/dependabot.yml

@@ -0,0 +1,41 @@
+version: 2
+
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: Europe/Bratislava
+    open-pull-requests-limit: 2
+    groups:
+      python-dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: npm
+    directory: /clients/web
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:15"
+      timezone: Europe/Bratislava
+    open-pull-requests-limit: 2
+    groups:
+      web-dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:30"
+      timezone: Europe/Bratislava
+    open-pull-requests-limit: 2
+    groups:
+      workflow-actions:
+        patterns:
+          - "*"

SECURITY.md

@@ -0,0 +1,26 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please do not open a public issue for a suspected vulnerability.
+
+Use GitHub's private vulnerability reporting for this repository when the **Report a vulnerability** action is available. If that interface is unavailable, email **[email protected]**.
+
+Include, where possible:
+
+- the affected commit, tag, or pre-release;
+- the security impact and who or what may be affected;
+- a minimal reproduction using synthetic data;
+- any known mitigations or workarounds.
+
+Do not send production credentials, personal data, private client material, or other live secrets. Replace them with synthetic examples.
+
+The maintainers will acknowledge the report and coordinate validation, remediation, and disclosure as project capacity allows. We do not promise a fixed response or remediation SLA while LychD is pre-release.
+
+## Supported versions
+
+LychD is pre-release software. Security work targets the current `main` snapshot and the latest published pre-release when one exists. Older commits, development branches, and unmaintained local modifications are not supported versions.
+
+## Coordinated disclosure
+
+Please allow the maintainers time to validate and mitigate the issue before public disclosure. When appropriate, remediation and disclosure will be coordinated through a GitHub Security Advisory.