hookified - chore: defense - record repository lockdown and completed manuals

[jaredwray]

Summary

Record a passing lockdown-repo.sh apply/--check (section 7), including immutable GitHub Releases, plus the maintainer-confirmed npm / account manuals. List the matching live controls in SECURITY.md.

Status update: DEFENSE_IN_DEPTH.md: lockdown (including immutable releases) → (PR #195 pending); npm stage-only / Drydock / 2FA / passkeys / recovery codes → verified (maintainer); Aikido release gate → PR #194. Catalog has no remaining unchecked items.

Changes

• Check off § 7 lockdown from the maintainer apply/--check with --required-checks "test,zizmor" and --allowed-actions "codecov/*,cloudflare/*".
• Record immutable GitHub Releases (enabled in the apply run: "enabled immutable releases").
• Check off § 5 manuals: stage-only OIDC trusted publishing, 2FA promotion, Drydock, 2FA + disallow tokens.
• Check off § 7 manuals: phishing-resistant 2FA (passkeys) and offline recovery codes (maintainer-confirmed earlier; the script still prints them as leftovers).
• Add SECURITY.md bullets for required PRs/status checks, admin-only tags, immutable releases, fork-PR approval, the Actions allowlist, and staged npm publishing.

Verification

• Maintainer apply reported immutable releases enabled and the rest of the GitHub settings written
• Confirmed rulesets Pull requests required and Tags only by admins are active on the repo
• Maintainer confirmed the remaining (manual) catalog items are complete

Reference: defense-in-depth-nodejs § 5–7

Please check if the PR fulfills these requirements

• Followed the Contributing and Code of Conduct guidelines.
• Tests for the changes have been added (for bug fixes/features) with 100% code coverage.

What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)
docs / security

  

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (7a23b9e) to head (0930d7d).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #195   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            5         5           
  Lines          433       433           
  Branches       109       109           
=========================================
  Hits           433       433           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.