chore: add CodeQL workflow, PR template, and Dependabot config

[nigel-dev]

Summary

Adds three new GitHub config files to improve repo hygiene and security scanning.

Changes

• CodeQL workflow (.github/workflows/codeql.yml) — Runs static analysis on PRs, pushes to main, and weekly schedule (Monday 6am UTC)
• PR template (.github/pull_request_template.md) — Standardizes PR descriptions with summary, changes, testing checklist, and notes sections
• Dependabot version updates (.github/dependabot.yml) — Weekly PRs for npm and GitHub Actions dependency updates with conventional commit prefixes

Notes

Part of a broader repo settings update that also applied these changes via the GitHub API:

• Enabled: delete branch on merge, auto-merge, update branch button, Dependabot security updates, vulnerability alerts
• Disabled: merge commits (squash + rebase only), wiki
• Added topics: opencode, mcp, git-worktree, ai-coding, cli-plugin, typescript, bun

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[nigel-dev]

@copilot can you review

[Copilot]

@nigel-dev I've opened a new pull request, #5, to work on those changes. Once the pull request is ready, I'll request review from you.