Parity wave 2: DS v2.10.1 Class C compliance; highlight.js inlined

.github/dependabot.yml

@@ -0,0 +1,30 @@
+# TGWAB dependency updates — DEV-STANDARDS §15.
+#
+# Place at:  .github/dependabot.yml
+#
+# Grouping caps a normal week at ~3 PRs instead of one per package — ungrouped
+# Dependabot is how automated updates get muted and then ignored.
+#
+# DO NOT use this for a pnpm-11 repo's npm dependencies (wizard-web). Dependabot
+# supports pnpm v7–v10 and cannot parse a pnpm 11 multi-document lockfile, so it
+# opens zero PRs while appearing configured. Use templates/renovate.json there —
+# this file's github-actions entry is still fine to keep alongside it.
+#
+# Class C Jekyll repos add a third entry with package-ecosystem: bundler.
+
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: America/New_York
+    open-pull-requests-limit: 2
+    labels: [dependencies]
+    commit-message:
+      prefix: "chore(actions)"
+    groups:
+      actions:
+        patterns: ["*"]

.github/workflows/ci.yml

@@ -0,0 +1,26 @@
+# §15 gates for a no-build single-file page. Deploy is GitHub Pages from main.
+name: ci
+on:
+  pull_request:
+  push:
+    branches: [main]
+permissions: {}
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      # §2 gate: the page (with inlined highlight.js) must be eval-free.
+      - run: ./scripts/no-eval.sh .
+      # §1 gate: no mailto: anywhere in the page.
+      - run: |
+          set -euo pipefail
+          if grep -n 'mailto:' index.html; then echo "::error::mailto: in page (§1)"; exit 1; fi

.gitignore

@@ -0,0 +1,10 @@
+# OS / editor cruft (§10)
+.DS_Store
+Thumbs.db
+*.swp
+.idea/
+.vscode/
+
+# Secrets never land in a repo (§10, §16)
+.dev.vars*
+.env*

README.md

@@ -1,6 +1,6 @@
 # GitHub Tree Browser
 
-A single-file, client-only explorer for browsing any **public GitHub repository** as a collapsible tree on **GitHub Pages**. Previews images inline, renders text & code files with syntax highlighting, and gives one-click **raw**, **CDN**, and **GitHub** links.
+A single-file, client-only explorer for browsing any **public GitHub repository** as a collapsible tree on **GitHub Pages**. **Class C micro-project** (§10): public, MIT, no custom domain. Previews images inline, renders text & code files with syntax highlighting, and gives one-click **raw**, **CDN**, and **GitHub** links.
 
 🔗 **Live:** [michalaferber.github.io/github-tree-browser](https://michalaferber.github.io/github-tree-browser/)
 
@@ -74,3 +74,13 @@ With a fine-grained PAT (no scopes needed for public repos, just `public_repo` i
 ## License
 
 MIT — see [LICENSE](LICENSE).
+
+## Credits
+
+| Component | Version | License |
+| --- | --- | --- |
+| [highlight.js](https://highlightjs.org) (inlined) | 11.9.0 | BSD-3-Clause |
+
+## Standards
+
+Built to the TGWAB Dev Standards **v2.10.1** (internal).