- Add code-quality.yml: Black formatting check, flake8 linting, bandit security scan - Add dependabot.yml: weekly updates for pip deps and GitHub Actions - Add requirements-dev.txt: single source of truth for CI dependencies - Harden test.yml: add permissions, pip caching, use requirements-dev.txt - Add Black/flake8/bandit config to pyproject.toml (line-length=88)