Repo hygiene: CI, CODEOWNERS, issue templates, branch protection, CodeQL

[DocNR]

Housekeeping backlog for the now-public repo. Verified current state via gh api/repo inspection, 2026-08-10.

• No GitHub Actions at all — .github/workflows/ doesn't exist yet. Two sub-tasks:
  • Proxy CI: node --test test/*.js on push/PR touching relay-proxy/**. Small, unblocked.
  • iOS CI: xcodebuild test. A prior attempt (closed PR ci: add iOS Build + Test GitHub Actions workflow #20) hit a real blocker — swift-secp256k1's SwiftPM plugin silently drops ECDH/schnorr modules in CI, undefined symbols at link time. Needs a fresh investigation (updated secp256k1 version, vendored static lib, or a different runner image) before this is worth re-attempting.
• No CODEOWNERS file — add .github/CODEOWNERS with * @DocNR.
• Issue templates are ad hoc — only a one-off nip46-interop-issue.md exists. Add structured bug_report.yml (build number, iOS version, client app, repro, expected/actual, logs) + feature_request.yml + config.yml linking SECURITY.md for vuln reports.
• Dependabot only does security alerts, not scheduled version updates — add .github/dependabot.yml with a monthly interval for npm (/relay-proxy) and swift (/).
• CodeQL code scanning isn't enabled — gh api repos/DocNR/clave/code-scanning/default-setup returns not-configured. Can likely just be flipped on via Settings → Code security → Code scanning → Default, no PR needed.
• Branch protection is minimal — required_approving_review_count: 0, enforce_admins: false, no required status checks. Worth tightening once the CI above exists (add it as a required check) and/or before a second maintainer joins.
• docs/SELF-HOSTING.md doesn't exist — README has a placeholder note only. Low priority — defer until an actual self-hoster asks in Issues.

Note: publishing the historical security audit report is intentionally left off this list — it documents Medium/Low findings that are still unpatched (tracked privately per the 2026-08-10 decision to keep the security-audit bucket out of public issues). Revisit once those are resolved.

Source: internal backlog triage, 2026-08-10.