Run the one-time setup scripts locally (admin + gh) — includes the 1-min merge-queue wait

[DenWin]

Follow-up from PR #16. The two setup/ scripts could not be executed from the remote session that authored the PR: they require the GitHub CLI authenticated with admin on the repo, and that environment has no gh and no API route for rulesets/security settings (both scripts exit 1 at their fail-fast guard, as designed).

Remaining work (run locally, after #16 merges)

pwsh -NoProfile -File setup/Protect-MainBranch.ps1
pwsh -NoProfile -File setup/Enable-RepoSecurity.ps1

• Run after Reduce merge-queue wait to 1 min; add MIGRATION.md entry doc + .vscode README #16 merges so the created main-protection ruleset carries the new min_entries_to_merge_wait_minutes = 1 (PR Reduce merge-queue wait to 1 min; add MIGRATION.md entry doc + .vscode README #16 changed it from 5).
• If a main-protection ruleset already exists, the script will fail on the POST — instead update the existing ruleset's merge-queue wait to 1 min in Settings → Rules (or delete and recreate via the script).
• Enable-RepoSecurity.ps1 is idempotent; plan-restricted settings warn and are skipped.
• Per setup/README.md: once protection is active, delete the setup/ folder (template guidance — optional for this template repo itself, since downstream repos still need the scripts).

Acceptance

• main-protection ruleset active on the default branch with merge-queue wait = 1 min
• Server-side security settings enabled (secret scanning + push protection, Dependabot alerts/fixes, private vulnerability reporting, read-only workflow token)