Harden workflow security, enhance .gitignore, and add status badges

[Copilot]

Implements security hardening for GitHub Actions workflows, comprehensive .gitignore patterns for sensitive data, and adds workflow status visibility.

Security Enhancements

Workflow Permissions

• Added explicit permissions: contents: read to CI workflow
• Granular job-level permissions in wiki-management workflow
• All workflows now follow principle of least privilege

API Key Handling

Before:

curl -s "${api_url}&apikey=${{ secrets.ETHERSCAN_API_KEY }}"

After:

env:
  ETHERSCAN_API_KEY: ${{ secrets.ETHERSCAN_API_KEY }}
run: |
  curl -s "${api_url}&apikey=${ETHERSCAN_API_KEY}"

Environment variable usage enables GitHub's automatic secret masking and reduces process listing exposure.

Enhanced .gitignore

• 12 categorized security sections (cryptographic material, cloud credentials, wallet files)
• Bitcoin-specific patterns: wallet.dat, peers.dat, chainstate/, mempool.dat
• Extended key formats: ECDSA, Ed25519, GPG, PGP
• Cloud provider credentials: AWS, Azure, GCP
• Lock file policy guidance

Visibility

Added workflow status badges to README:

• CI
• Etherscan API Integration
• Wiki Management

Files Changed

• .gitignore: +222 lines (reorganized with security categories)
• .github/workflows/: Explicit permissions, safer secret handling
• README.md: Status badges

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.