docs(security): record GitHub security settings evidence (Task 07)

Enable private vulnerability reporting and record read-back evidence.

Settings changed (each approved immediately before, verified by read-back):
- Private vulnerability reporting: enabled=false -> enabled=true. The
  Security tab now offers "Report a vulnerability", making the path
  documented in SECURITY.md live.
- Dependency Graph / Dependabot alerts: 404 -> 204. This was an
  undocumented prerequisite of Task 08's dependency-review.yml, which
  failed with "Dependency graph is not enabled"; the Dependency Review
  check on PR #336 went fail -> pass after enabling it.

No other repository setting was modified; secret scanning and push
protection are unchanged, and dependabot_security_updates remains disabled
(out of scope, would need its own approval). Both changes are reversible
via the corresponding DELETE calls.

Marks Part B of the private-vulnerability-reporting checklist complete.

docs/maintenance/repository-recovery/private-vulnerability-reporting-checklist.md

@@ -22,14 +22,17 @@ feature — they document how to use it once enabled.
 > ⚠️ The following change live GitHub state, not files. Each requires explicit
 > approval immediately before it is made, and is verified by read-back.
 
-- [ ] Enable **Private vulnerability reporting**
+- [x] Enable **Private vulnerability reporting** _(done 2026-07-15)_
   - Settings → Code security and analysis → Private vulnerability reporting → Enable.
   - API: `PUT /repos/{owner}/{repo}/private-vulnerability-reporting`.
-  - Read-back: `GET /repos/{owner}/{repo}/private-vulnerability-reporting` shows `enabled: true`.
-- [ ] Confirm the **Security** tab now offers "Report a vulnerability" so the
-      path documented in `SECURITY.md` is live.
-- [ ] Record evidence in
-      `docs/maintenance/repository-recovery/private-vulnerability-reporting-evidence.md`.
+  - Read-back: `GET /repos/{owner}/{repo}/private-vulnerability-reporting` shows `enabled: true`. ✅
+- [x] Confirm the **Security** tab now offers "Report a vulnerability" so the
+      path documented in `SECURITY.md` is live. ✅
+- [x] Record evidence in
+      `docs/maintenance/repository-recovery/private-vulnerability-reporting-evidence.md`. ✅
+- [x] **Dependency Graph** enabled (prerequisite discovered in Task 08 —
+      `dependency-review.yml` requires it). `PUT /repos/{owner}/{repo}/vulnerability-alerts`,
+      read-back `HTTP 204`. ✅
 
 ## Notes
 

docs/maintenance/repository-recovery/private-vulnerability-reporting-evidence.md

@@ -0,0 +1,63 @@
+# GitHub Security Settings — Change Evidence
+
+_Repository-recovery Task 07 (private vulnerability reporting), plus the
+Dependency Graph prerequisite discovered during Task 08._
+_Repository: `darrenhinde/OpenAgentsControl` (public). Date: 2026-07-15._
+
+Each change below was explicitly approved immediately before it was made, and
+verified by read-back. No other repository setting was modified.
+
+## Change 1 — Dependency Graph / Dependabot alerts (Task 08 prerequisite)
+
+Discovered while adding `dependency-review.yml`: the Dependency Review action
+fails with _"Dependency review is not supported on this repository. Please ensure
+that Dependency graph is enabled"_ unless the Dependency Graph is on.
+
+| Step | Command | Result |
+|------|---------|--------|
+| Before | `GET /repos/darrenhinde/OpenAgentsControl/vulnerability-alerts` | `HTTP 404` (disabled) |
+| Enable | `PUT /repos/darrenhinde/OpenAgentsControl/vulnerability-alerts` | `HTTP 204` |
+| Read-back | `GET /repos/darrenhinde/OpenAgentsControl/vulnerability-alerts` | `HTTP 204` (enabled) |
+
+**Verification:** the `Dependency Review` check on PR #336 went from `fail` (4s,
+"Dependency graph is not enabled") to `pass` (9s) after this change.
+
+## Change 2 — Private vulnerability reporting (Task 07)
+
+Makes the reporting path documented in `SECURITY.md` live.
+
+| Step | Command | Result |
+|------|---------|--------|
+| Before | `GET /repos/darrenhinde/OpenAgentsControl/private-vulnerability-reporting` | `{"enabled": false}` |
+| Enable | `PUT /repos/darrenhinde/OpenAgentsControl/private-vulnerability-reporting` | `HTTP 204` |
+| Read-back | `GET /repos/darrenhinde/OpenAgentsControl/private-vulnerability-reporting` | `{"enabled": true}` |
+
+**Verification:** the repository Security tab now offers **Report a
+vulnerability**, so the path documented in `SECURITY.md` resolves.
+
+## Settings not changed
+
+Confirmed unchanged before and after (`GET /repos/{owner}/{repo}` →
+`security_and_analysis`):
+
+```json
+{
+  "dependabot_security_updates": { "status": "disabled" },
+  "secret_scanning": { "status": "enabled" },
+  "secret_scanning_non_provider_patterns": { "status": "disabled" },
+  "secret_scanning_push_protection": { "status": "enabled" },
+  "secret_scanning_validity_checks": { "status": "disabled" }
+}
+```
+
+Note: `dependabot_security_updates` (automated fix PRs) remains **disabled** —
+it was not in scope for Task 07 and would require its own approval. Dependabot
+alerts are now on via the Dependency Graph change above; `.github/dependabot.yml`
+is scoped to `github-actions` updates only.
+
+## Reversal
+
+Both changes are reversible with the corresponding `DELETE` calls:
+
+- `DELETE /repos/{owner}/{repo}/private-vulnerability-reporting`
+- `DELETE /repos/{owner}/{repo}/vulnerability-alerts`