chore: add maintainer ownership, dependency and security automation

.github/CODEOWNERS

@@ -0,0 +1,12 @@
+# Default ownership
+* @BLCCoreStudio
+
+# Canonical knowledge and automation surfaces
+/.github/ @BLCCoreStudio
+/catalog/ @BLCCoreStudio
+/taxonomy/ @BLCCoreStudio
+/schema/ @BLCCoreStudio
+/quality/ @BLCCoreStudio
+/scripts/ @BLCCoreStudio
+/INDEX.md @BLCCoreStudio
+/ROADMAP.md @BLCCoreStudio

.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - ci

.github/release.yml

@@ -0,0 +1,34 @@
+changelog:
+  exclude:
+    labels:
+      - ignore-for-release
+    authors:
+      - dependabot
+  categories:
+    - title: Knowledge and coverage
+      labels:
+        - content
+        - coverage
+    - title: Corrections
+      labels:
+        - correction
+        - bug
+        - fix
+    - title: Features and structure
+      labels:
+        - enhancement
+        - feature
+    - title: Security
+      labels:
+        - security
+    - title: Documentation
+      labels:
+        - documentation
+    - title: Maintenance
+      labels:
+        - dependencies
+        - maintenance
+        - ci
+    - title: Other changes
+      labels:
+        - '*'

.github/workflows/codeql.yml

@@ -0,0 +1,36 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '17 4 * * 3'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze Python tooling
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
+        with:
+          languages: python
+      - name: Analyze
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
+        with:
+          category: /language:python

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,26 @@
+name: Dependabot Auto Merge
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  dependabot:
+    if: github.event.pull_request.user.login == 'dependabot[bot]' && github.event.pull_request.base.ref == 'main' && github.repository_owner == 'BLCCoreStudio'
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Fetch Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3
+        with:
+          github-token: ${{ github.token }}
+      - name: Enable auto-merge for patch updates
+        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: gh pr merge --auto --squash "$PR_URL"

SUPPORT.md

@@ -0,0 +1,23 @@
+# Support
+
+OpenDevIndex is a curated technical knowledge project. Support and contribution channels are separated so factual corrections, new content requests, and software defects can be triaged differently.
+
+## Incorrect or outdated technical content
+
+Use the content correction issue form. Identify the exact module or section, explain what is incorrect or outdated, and provide authoritative sources where possible.
+
+## New topics or deeper coverage
+
+Use the content request form. Explain why the topic belongs in the index, how it relates to existing modules, and which authoritative sources should anchor it.
+
+## Tooling or repository bugs
+
+Use the bug report form with reproduction steps, affected workflow or script, expected behavior, actual behavior, and logs.
+
+## Security
+
+Do not disclose vulnerabilities publicly. Follow `SECURITY.md`.
+
+## Maintenance priority
+
+The maintainer prioritizes factual correctness, source quality, broken validation or publishing pipelines, security, structural integrity of the knowledge graph, and high-value gaps in core technical coverage. Requests may be declined when they duplicate existing material or do not meet sourcing and depth standards.