chore: adopt devkit baseline (CI, security, Claude rules) + fix 2 type errors

[RickCogley]

Summary

Implements the punch list from #8. Closes #8.

Hibana publishes to deno.land/x (not JSR) — per project memory and the README, JSR is intentionally not used because Lume's dev resists JSR (no http imports support), and hibana follows Lume's hosting choice. So no publish.yml here. The deno.land/x webhook handles publish on tag push.

What's in this PR

CI / Security (none previously)

File	Role
.github/workflows/ci.yml	fmt + lint + check on PR/main pushes
.github/workflows/security.yml	wrapper triggering vendored security scan
.github/workflows/secrets-and-sast-vendored.yml	451-line copy of devkit's reusable workflow (vendored because hibana is public + cross-org)
.github/dependabot.yml	weekly github-actions + npm (docs-site) updates

Claude tooling

• .claude/rules/change-management.md (copy from devkit shared-rules; adapted to mention deno.land/x publishing flow)
• .gitignore updated to allow tracking .claude/rules/ (was ignoring all of .claude/)

Type-error fixes

Two pre-existing type errors fixed (both same root cause):

• processors/vento_heading_anchors.ts:120
• processors/vento_toc.ts:163

Both had Required<...Options> annotations on options merging, but containerSelector is genuinely optional (undefined means "scan whole document"). Aligned the annotations to Pick out containerSelector as optional, matching the existing pattern in the corresponding defaults declarations.

Deno hygiene

• Drop name: "@rick/hibana" from deno.json — JSR-style scope but hibana doesn't publish to JSR (verified: jsr.io 404). Field was misleading about the publish target.
• Add preflight task.
• Scope the check task to deno check mod.ts instead of deno check **/*.ts — the glob picked up docs-site/ Astro internals and root-level scripts and produced 11k+ unrelated errors. mod.ts is the public entry point.
• Commit deno.lock for reproducibility (was untracked; both global and project gitignore had been ignoring it).
• .gitignore overrides for !deno.lock (global ignores it) and !.github/workflows/*secret* (global pattern matches the vendored filename).

Tests deliberately not in CI yet

CI is fmt + lint + check only — deno test is not in the workflow because 7 tests fail on main of v1.3.0 (pre-existing, not caused by this PR). All seven are in:

• preprocessors/__tests__/language_alternates_schema.test.ts (4 failing)
• preprocessors/__tests__/markdown_metadata.test.ts (3 failing)

All fail with AssertionError: Values are not equal — looks like value drift after recent upgrades.

Tracked in #9 (with acceptance criteria including re-enabling deno test in ci.yml once they're fixed).

Out of scope (flagged in commit message)

• Fix the 7 failing tests → tracked in test: 7 pre-existing test failures in preprocessors (likely upgrade drift) #9
• Remove no-explicit-any lint exclusion + fix the ~18 any usages
• Move root-level scripts (release.ts, generate_readme*.ts, update_lume_version.ts) into scripts/
• Investigate whether generate_readme2.ts is dead code

Test plan

• deno fmt --check passes
• deno lint passes
• deno check mod.ts passes (was failing with 2 errors on main; this PR fixes them)
• deno test --allow-read --unstable-temporal — 13 passed, 7 failing pre-existing (tracked in test: 7 pre-existing test failures in preprocessors (likely upgrade drift) #9)
• CI workflow runs green on this PR
• Security workflow runs green (first SAST/secrets/SBOM run for hibana)

InfoSec: brings continuous SAST + secret scanning + SBOM coverage to a repo that previously had zero security automation. The 2 type-error fixes are correctness improvements (avoid undefined access on options.containerSelector later in the code).