feat(template): add task setup:github for idempotent repo settings

[evanharmon1]

Summary

The post-generation GitHub setup (CHECKLIST §2) was entirely manual. This adds a
task setup:github target to the generated Taskfile that applies the
fully idempotent, no-credential settings via gh — safe to re-run:

• enable Dependabot alerts (PUT repos/$R/vulnerability-alerts)
• enable private vulnerability reporting (PUT .../private-vulnerability-reporting)
• set the FULL_SECURITY_SCAN variable (CodeQL)
• (org repos only) add the <user>-bot account as a Write collaborator

setup:github:
  vars:
    REPO: "[[ github_org ]]/[[ project_slug ]]"
  cmds:
    - gh api "repos/{{.REPO}}/vulnerability-alerts" --method PUT
    - gh api "repos/{{.REPO}}/private-vulnerability-reporting" --method PUT
    - gh variable set FULL_SECURITY_SCAN --repo "{{.REPO}}" --body true
[% if github_org != author_git_provider_username %]
    - gh api "repos/{{.REPO}}/collaborators/[[ author_git_provider_username ]]-bot" --method PUT -f permission=push
[% endif %]

The collaborator step is jinja-gated to org repos (mirroring the CHECKLIST's
existing github_org != author_git_provider_username gate), so a personal repo's
rendered task omits it.

Deliberately left manual

Anything needing a browser OAuth consent (Renovate / CodeRabbit app installs,
GHCR publishing policy, CI GitHub App creation) or a real credential
(CLAUDE_CODE_OAUTH_TOKEN, SNYK_TOKEN, CI_APP_*, Project V2). The branch
ruleset import also stays manual — its POST /rulesets isn't idempotent (a guard
keyed on the ruleset name would be needed); I added an ordering note instead.

CHECKLIST §2 now leads with task setup:github and drops the three folded bullets
(Advanced Security, FULL_SECURITY_SCAN, bot collaborator).

Test plan

• task test:template:all passes (all 5 profiles). ✅
• Org render (github_org=someorg): REPO=someorg/..., collaborator line + "bot
  collaborator" in the desc present; task --list-all parses it. ✅
• Personal render (default org): no collaborator line (0 matches), desc without
  "bot collaborator". ✅
• Rendered docs/CHECKLIST.md §2 reads correctly with no leaked jinja markers. ✅

Context

Third in the series surfaced while applying the template to sommerlawn-infra
(after #84 markdownlint fixes and harmon-devkit#22). Scope was confirmed with the
maintainer: only the four fully-idempotent operations, nothing requiring guards,
credentials, or a browser.

🤖 Generated with Claude Code