Harden CLI repository security

[talBrau]

What changed

• add read-only, SHA-pinned CI for tests, typechecking, builds, plugin validation, and package inspection
• add CODEOWNERS and pull request guidance
• add Dependabot updates for npm and GitHub Actions
• add private security-reporting instructions and contributor guidance
• make the full validation suite run before npm publishing

Why

The CLI reads local project files and uploads reviewed snapshots, so its public repository needs reproducible checks, explicit ownership, controlled dependency updates, and a private vulnerability-reporting path before broader distribution.

Validation

• npm run check
• npm pack --dry-run
• CI and Dependabot YAML parsed successfully