[ryanduguid]

Summary

Makes the repository safer to depend on: a security policy, a changelog, automatic dependency updates, workflow actions pinned to commit SHAs, and tests for gaps that could drift unnoticed.

• SECURITY.md: private reporting through GitHub, with what a sole maintainer can honestly offer. Fixes land on main and reach binaries only through a later release.
• CHANGELOG.md, plus a test that fails when plugin manifests disagree or lose their version.
• .github/dependabot.yml and SHA-pinned uses: lines, each enforced by a test.
• A stdio smoke test for tools/laconic-check/mcp/server.mjs, which had none, with a CI build step so it does not always skip.
• The Gemini prompt's errors rule now matches the canonical skill, with a drift test.
• CONTRIBUTING.md no longer requires labels that do not exist.
• INSTALL.md: Copilot paths corrected against GitHub's docs.

Evidence

• Before: 127 unit tests; 14 unpinned uses: lines; server.mjs untested.
  After: 138 unit tests pass; run_evals.py validate passes; laconic-check lint clean on the changed Markdown.
• Each new guard failed on a planted fault or with its fix removed, except the MCP smoke test's skip paths, which were checked by removing node or the binary.
• Private vulnerability reporting read back enabled: true from the API.

Merge danger

Door: two-way. Blast radius: CI

A wrong pin would fail a workflow on its next run. The pinned SHAs were resolved through the REST API and matched locally.

Unverified

• These workflows have not yet run on GitHub; this PR is their first run.
• The CodeQL pin was already 62 commits behind v4; left for Dependabot.
• server.mjs reports version 0.1.0 whilst the crate is 0.2.0; not changed here.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud