docs(standards): propose push protection standard

AGENTS.md

@@ -20,6 +20,7 @@ Read the relevant standard *before* making changes that touch CI, repo settings,
 | **Agent configuration** | [`standards/agent-standards.md`](https://github.com/petry-projects/.github/blob/main/standards/agent-standards.md) | CLAUDE.md / AGENTS.md / SKILL.md required structure, frontmatter rules, cross-references |
 | **Repo settings + labels** | [`standards/github-settings.md`](https://github.com/petry-projects/.github/blob/main/standards/github-settings.md) | Required settings, label set with exact colors, code-quality ruleset, branch protection |
 | **Dependabot config** | [`standards/dependabot-policy.md`](https://github.com/petry-projects/.github/blob/main/standards/dependabot-policy.md) and [`standards/dependabot/`](https://github.com/petry-projects/.github/tree/main/standards/dependabot) | Per-ecosystem dependabot.yml templates and policy |
+| **Push protection** | [`standards/push-protection.md`](https://github.com/petry-projects/.github/blob/main/standards/push-protection.md) | Secret scanning + push protection, local gitleaks hooks, CI secret-scan job, incident response |
 
 **When fixing a compliance finding, the rule is: read the standard, then copy
 the template — do not generate from scratch.** Anything generated from scratch

standards/github-settings.md

@@ -33,6 +33,22 @@ SHOULD be audited and brought into compliance.
 | **Has Wiki** | `false` | Disabled — documentation lives in the repo |
 | **Has Discussions** | `true` | **Required** — enables Discussions for ideation, feedback, and community engagement (see [Discussions Configuration](#discussions-configuration)) |
 
+### Security & Analysis
+
+All repositories MUST have the following security features enabled. These are
+the enforcement primitives behind the [Push Protection Standard](push-protection.md).
+
+| Setting | Standard Value | Rationale |
+|---------|---------------|-----------|
+| **Secret scanning** | `enabled` | Detect leaked credentials in history and new commits |
+| **Secret scanning push protection** | `enabled` | Block pushes containing known secret patterns at the server side |
+| **Secret scanning AI detection** | `enabled` | Catch generic secrets missed by regex patterns |
+| **Secret scanning non-provider patterns** | `enabled` | Private keys, HTTP basic auth, high-entropy strings |
+| **Dependabot security updates** | `enabled` | Automated patches for known-vulnerable dependencies |
+
+> See the full requirements, custom patterns, CI job, incident response flow,
+> and compliance audit checks in [`push-protection.md`](push-protection.md).
+
 ### Merge Settings
 
 | Setting | Standard Value | Rationale |