Add GitHub rulesets and security automation for branch protection

[Copilot]

Implements declarative branch protection, tag protection, and automated security scanning using GitHub's native ruleset features.

Ruleset Configurations

5 JSON ruleset templates in .github/rulesets/:

• branch-protection-main.json - 2 required reviews, signed commits, linear history, all checks required
• branch-protection-release.json - Same as main, no bypass actors
• branch-protection-dev.json - 1 review, basic checks
• tag-protection.json - Prevents unauthorized tag creation/modification/deletion
• security-checks.json - Mandatory security scans on all branches (excludes bot branches)

Code Ownership & Security Workflows

• .github/CODEOWNERS - Ownership mappings for consensus, wallet, networking, crypto, testing, build system, CI/CD, security, documentation
• .github/workflows/security-checks.yml - Dependency review, secret scanning (Gitleaks), vulnerability scanning (Trivy), security linting (Semgrep), permissions validation, signature verification
• .github/workflows/validate-rulesets.yml - Automatic validation on ruleset changes

Automation

• .github/validate-rulesets.py - Validates JSON structure, security best practices, branch protection requirements
• .github/apply-rulesets.sh - Applies rulesets via GitHub API with prerequisite checks

Documentation

• .github/rulesets/README.md - Ruleset details, safe practices, customization guide
• .github/SECURITY_MANAGEMENT.md - Security strategy, GPG setup, incident response, compliance
• .github/QUICK_START_RULESETS.md - Step-by-step deployment via UI/API/CLI
• README.md - Added security section with references

Usage

# Validate rulesets
python3 .github/validate-rulesets.py

# Apply to repository (requires gh CLI + admin access)
.github/apply-rulesets.sh

Note: Rulesets must be applied via GitHub Settings or API. JSON files serve as version-controlled templates requiring customization of status check contexts, team IDs, and bypass actors.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.