Dependabot security alerts as a hub status category

[ooloth]

Why

Security vulnerabilities in watched repos need timely attention, but hub surfaces nothing about them today — they're only visible if you check GitHub's security tab directly.

Current state

hub status shows PRs awaiting review and open/assigned GitHub issues. There is no section for security alerts. Dependabot alert data is available via the GitHub REST API but is not fetched or displayed.

Ideal state

• hub status includes a "security alerts" section listing open Dependabot alerts across configured repos
• Each alert shows: repo, package name, severity, and URL
• Alerts are sorted by severity (critical → high → medium → low)
• The section is omitted when there are no open alerts
• The workflow is configurable per-repo in hub.toml using a github-dependabot workflow name

Starting points

• clients/src/github.rs — existing GitHub client pattern to follow
• config/src/toml.rs — where WorkflowConfig variants are defined
• workflows/src/status.rs — where new workflow calls should be added

QA plan

1. Add a github-dependabot workflow entry to hub.toml for a repo with known open Dependabot alerts
2. Run hub status — expect a "security alerts" section listing each alert with severity and URL
3. Dismiss an alert in GitHub, re-run hub status — expect that alert no longer appears
4. Add the workflow for a repo with no open alerts — expect the section is omitted from output
5. Remove all github-dependabot entries from hub.toml — expect no security alerts section appears

Done when

hub status shows open Dependabot security alerts for configured repos, sorted by severity.

[ooloth]

Roadmap update: demoting from next to later.

Dependabot alerts are a valid signal but not on the critical habit-forming path right now. They surface things already visible on GitHub, in a category where GitHub's own notifications likely already fire.

The higher-leverage next steps are urgency ranking (transforms the daily experience for all existing signals) and Loki (the first signal that tells you something you didn't already know). Revisit once those land.