Complete repository-level security controls for Jules dispatcher

[mark-e-deyoung]

The code-level hardening is implemented; the remaining P0/P1 controls require GitHub administrative settings rather than repository code.

P0 — required before treating the dispatcher as safely reusable

• Configure Workflow Execution Protection so only the designated operator (or a very small maintainer group) can manually execute the secret-bearing workflow.
• Protect main with a ruleset/branch protection policy:
  • require pull requests for changes;
  • require CODEOWNER review for security-sensitive paths;
  • restrict direct pushes;
  • block force pushes;
  • block branch deletion.
• Create/configure the jules-dispatch Environment and require reviewer approval while the experiment is in Phase 0.
• Add secret JULES_TARGETS_JSON containing only approved target aliases. Do not use repository variables for private target names.

P1 — hardening verification

• Review organization/repository Actions policy and allow only trusted/GitHub-authored actions; require immutable SHA pinning where practical.
• Confirm public workflow logs no longer expose private repository names, branches, Jules session IDs/URLs, source IDs, or PR metadata.
• Review the Jules account's connected Sources and remove any repositories that do not need to be reachable by this dispatcher account/key.
• Rotate JULES_API_KEY if there is any concern that an earlier public run exposed credential material (current observed logs masked it).

Implemented in repository code

• Actor guard in the dispatch job.
• Secret-backed opaque target policy (JULES_TARGETS_JSON).
• Fixed public task registry (config/tasks.json).
• No free-form prompts or arbitrary task paths.
• Fail-closed target/task validation.
• Sanitized provider errors and public dispatch output.
• Public status workflow removed.
• actions/checkout pinned to an immutable commit with persistent credentials disabled.
• Security-sensitive CODEOWNERS entries.
• Threat model, logging/event policy, and incident response documented in SECURITY.md.

This issue should remain open until the GitHub-admin controls are confirmed.