chore(ci): add crawl security baseline

[vincentkoc]

Summary

• add CODEOWNERS coverage for security-sensitive automation and release surfaces
• add Dependabot coverage for GitHub Actions and Go modules
• add stale issue/PR automation aligned with the OpenClaw/ClawHub policy split
• add Go repository hygiene files for editor and line-ending normalization
• add a standalone TruffleHog verified-secret scanning gate
• keep CodeQL on GitHub default setup instead of adding a conflicting advanced workflow

Verification

• git diff --check
• actionlint