Complete Security Defaults and Reporting Flow

[FMCalisto]

This issue tracks the remaining security configuration work for the source template repository.

Scope:

• review which repository security features should be enabled by default for this source template
• confirm whether secret scanning and push protection are available and appropriate for this repository
• ensure the documented security reporting path matches the live GitHub security configuration

Acceptance criteria:

• security settings are intentionally configured rather than left as implicit defaults
• the repository security policy matches the live reporting path
• any remaining limitations are documented explicitly

Validation expectations:

• confirm settings through GitHub repository metadata
• verify that public documentation does not contradict the live security configuration