Add Dependabot config, security policy and PyPI release workflow

[devRMA]

The repository had none of these. Dependabot alerts were enabled but
security updates were not, so the 16 alerts accumulated for two years
with nothing opening a pull request to fix them.

• dependabot.yml: pip and github-actions ecosystems, monthly, with
  dev minor/patch updates grouped into a single pull request. Grouping
  is what keeps this sustainable; ungrouped, a stale lock produces a
  flood that gets ignored. Monthly rather than weekly to match the
  repository's actual pace. Because the actions are pinned by SHA,
  Dependabot updates the SHA and the version comment together.

• SECURITY.md: supported versions and private reporting through GitHub
  Security Advisories. Private vulnerability reporting has to be enabled
  in the repository settings for the advisory link to work for
  non-collaborators.

• release.yml: publishes on a published GitHub release using PyPI
  Trusted Publishing (OIDC), so no long-lived PyPI API token is needed.
  It asserts the git tag matches the version in pyproject before
  building, because nothing else catches that mismatch. id-token: write also covers the PEP 740 attestations that the publish action
  generates by default.

Verified poetry build produces correct metadata under the new PEP 621
layout: Requires-Python >=3.10, classifiers generated for 3.10-3.14, and
stopwatch/py.typed still shipped so PEP 561 typing keeps working.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
stopwatch2-omip	Error		Aug 2, 2026 7:53pm