Foundation: repository hygiene for secrets, dependencies, and notebook outputs #71

Goal

Make it hard to commit a key or a noisy notebook by accident.

Scope

• Secret scanning in CI, including inside notebook outputs.
• A check that notebooks carry no absolute local paths, usernames, or environment dumps in outputs.
• Dependabot configuration for Python dependencies and GitHub Actions.
• pre-commit configuration mirroring the CI checks, optional for contributors.

Acceptance criteria

• A planted fake key in a notebook output fails CI, demonstrated in the pull request description and not left in the branch
• Checks run in under a minute
• Lint and tests pass in CI, or locally with the output pasted in the pull request if CI does not exist yet

Dependencies

• Blocked by Foundation: CI baseline for lint, tests, and the README catalog check #62 (CI baseline for lint, tests, and the README catalog check)
• Tracked in Epic: Foundation #74

References

• Recipe contract
• Catalog
• TypeSafe documentation index for tools: https://docs.typesafe.ai/llms.txt
• Python SDK: https://docs.typesafe.ai/sdk/python