MANUAL RUN: GitHub ruleset on main and tags, Dependabot alerts, a drops environment #652

Found in the security audit (notes/SECURITY_AUDIT.md). These are GitHub settings only you can change (repo admin), all free:

1. Ruleset on main (Settings → Rules → Rulesets → New branch ruleset, target main):
   • Block force pushes and deletion.
   • Require a pull request (0 approvals is fine for a solo repo; it stops direct pushes from agents).
   • Require status checks: typecheck, and apps checks.
   • Optional once CODEOWNERS lands: require code owner review.
   • Bypass list: you only.
2. Tag ruleset for *-v*: restrict creation to you. A tag push triggers a real drop with R2 secrets and a public release.
3. Settings → Code security: turn on Dependabot alerts and security updates (secret scanning and push protection are already on). Turn on private vulnerability reporting if it isn't (SECURITY.md points to it), and secret scanning validity checks.
4. Actions → General: "Require approval for all outside collaborators" for fork PRs; keep the default token read-only (it is).
5. Environments: create a drops environment with you as required reviewer and move DROPS_CLOUDFLARE_API_TOKEN and DROP_SECRET into it, then add environment: drops to the drop job (a one-line PR afterwards).

Check: gh api repos/QuinnsCode/RustyBuns/rulesets lists two rulesets, and gh api repos/QuinnsCode/RustyBuns/branches/main/protection stops returning 404 (or rulesets show on the branch).