chore: prepare repository for public maintenance

[fly1d]

Summary

• upload CodeQL results now that the repository is public while retaining the warning/error gate
• run the required desktop status on every pull request so branch protection cannot wait forever
• add a private security-report contact link and public status badges
• document the enforced branch process and current unlicensed status

Local verification

• npm run check
• npm run test:smoke (5 passed, 1 environment-specific test skipped)
• npm run desktop:check (2 Rust tests passed)
• YAML parse and git diff --check

License

This PR does not grant an open-source license; the project remains UNLICENSED.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[fly1d]

Reviewed the complete diff against the public-repository settings. CodeQL upload is scoped to security-events, the existing warning/error SARIF gate remains intact, every PR now emits the required desktop status, and the security reporting link targets the enabled private advisory flow. Local and GitHub checks pass, native CodeQL upload is visible, and there are zero open code-scanning alerts. No blocking findings.