Enable a working private vulnerability and repository security baseline

[dajiaohuang]

Audit evidence

A 2026-08-27 audit of all nine active SagaSmith repositories found the same repository-security state everywhere:

• secret scanning: disabled
• push protection: disabled
• Dependabot security updates: disabled
• private vulnerability reporting: disabled

The organization SECURITY.md currently directs reporters to GitHub private vulnerability reporting first, so the documented primary path is not actually available. SagaSmith-agent/SECURITY.md also still identifies the project as NanoBot and points SagaSmith-specific reports to the upstream maintainers.

Affected repositories

• .github
• SagaSmith-agent
• Sagasmith-core
• Sagasmith-dnd
• Sagasmith-coc
• sagasmith-narrative
• SagaSmith-service
• SagaSmith-dnd-content-library
• SagaSmithAI.github.io

Acceptance criteria

• Decide the organization-wide reporting path supported by the current GitHub plan.
• Enable private vulnerability reporting where available, or update SECURITY.md to a working private channel before advertising it.
• Enable secret scanning and push protection where available; document any plan-limited exceptions.
• Enable Dependabot security updates with a reviewed organization policy and no surprise auto-merge behavior.
• Replace the NanoBot-branded Agent reporting instructions with SagaSmith ownership, forwarding upstream only after confirming an upstream-owned defect.
• Verify each enabled setting through the GitHub API and record the result without exposing reports or credentials.

This issue tracks configuration and reporting only. It must not add tokens, secrets, or vulnerability details to public comments.