chore: repo hygiene — CodeQL, Dependabot, SECURITY.md, badges

[nvandessel]

Summary

• CodeQL scanning workflow (weekly + on PRs)
• Dependabot for pip and GitHub Actions dependencies
• SECURITY.md with vulnerability reporting process
• README badges: tests, CodeQL, license, Python version
• Coverage reporting in CI
• Repo description and topics set

No PyPI deployment

Not needed yet — hippofloop is used locally via uv run hippofloop. PyPI publishing can be added when there's a stable release.

[greptile-apps]

Greptile Summary

This PR adds standard repo hygiene: CodeQL default-setup scanning, Dependabot for pip and GitHub Actions, a SECURITY.md, README badges, and coverage reporting in CI. All previous review concerns (broken CodeQL badge, misleading "Email:" label, inconsistent action pinning) have been addressed in prior commits.

• .github/dependabot.yml — weekly updates for both pip and github-actions ecosystems, with sensible PR limits
• .github/workflows/test.yml — coverage reporting added via --cov=hippofloop --cov-report=term-missing; pytest-cov>=5.0 is already declared in the dev extra in pyproject.toml, so no missing dependency
• .gitignore — .coverage correctly excluded to avoid committing coverage data
• README.md — four badges added; the CodeQL badge URL uses the github-code-scanning/codeql path appropriate for GitHub's default setup (not a custom workflow file)
• SECURITY.md — clean security policy pointing reporters to GitHub private security advisories with a 72-hour response SLA

Confidence Score: 5/5

Safe to merge — all changes are additive repo hygiene with no logic or runtime risk.

All prior review concerns have been resolved. No P0 or P1 issues found. Every change is either a new config file, a CI flag backed by an already-declared dependency, or a documentation update.

No files require special attention.

Important Files Changed

Filename	Overview
.github/dependabot.yml	New Dependabot config enabling weekly updates for pip and GitHub Actions dependencies — looks correct and well-configured.
.github/workflows/test.yml	Adds pytest-cov flags to the test step; pytest-cov>=5.0 is already listed in dev dependencies in pyproject.toml, so no missing dependency issue.
.gitignore	Adds .coverage to gitignore — correct companion to the new coverage reporting step.
README.md	Adds four badges (Tests, CodeQL, License, Python); CodeQL badge now correctly points to github-code-scanning/codeql for the default setup workflow, addressing the prior broken-badge issue.
SECURITY.md	New security policy file with private advisory link and 72-hour SLA; misleading 'Email:' label from earlier review has been removed.

_{Reviews (4): Last reviewed commit: "fix: CodeQL badge URL for default setup ..." | Re-trigger Greptile}