chore: SafeguardJava repo hygiene

[petrsnd]

Summary

Repository hygiene follow-up for SafeguardJava security review.

Commits

• b5cdac9 — adds Dependabot configuration for automated dependency update visibility.
• 59db67e — adds CodeQL workflow for continuous static analysis coverage.

Notes

No product code changes are included in this hygiene branch.

[petrsnd]

Partial live verification against 192.168.117.15 admin smoke 2026-05-26. Manual Java SDK read-only probe passed; oversized response cap was not safely triggerable live. Full log: .security-review-impl-logs/live-sweep/java-live.log

[petrsnd]

Full live appliance sweep re-run (mutation allowed) completed against 192.168.117.15.

Results:

• SafeguardDotNet (security/review-20260522-dotnet): 15 suites, 71 passed / 0 failed / 2 skipped. SpsIntegration excluded because no SPS appliance was in the lease. Cleanup audit: no SgDnTest objects remained.
• PySafeguard (security/review-20260522-py): after installing the optional SignalR extra required by event tests, full pytest passed: 453 passed / 0 failed / 0 skipped. Cleanup audit found one leaked PySg_ event-test user; it was deleted and re-audit showed 0 remaining.
• safeguard.js (security/review-20260522-js): integration suite passed: 11 files, 55 passed / 0 failed / 0 skipped. Cleanup audit: no SgJs_ objects remained.
• safeguard-bash (security/review-20260522-bash): full suite executed with SAFEGUARD_ALLOW_LOCALHOST=1 after the stock runner PKCE preflight failed against the private appliance address. Result: 14 suites, 323 passed / 10 failed / 0 skipped. Failures are confined to A2A and A2A Access Request Broker retrieval/broker negative-path checks. Cleanup audit: no SgBashTest objects remained.
• SafeguardJava (security/review-20260522-java): PowerShell integration runner passed: 9 suites, 59 passed / 0 failed / 0 skipped; SpsIntegration excluded because no SPS appliance was in the lease. FP-004 cap regression unit test also passed: 6 passed / 0 failed / 0 skipped. Cleanup audit: no SgJTest objects remained.

Lease released in SECURITY-REVIEW.md. Follow-up needed: investigate safeguard-bash A2A failures and the PySafeguard event-test cleanup leak.