ci: add push protection monitoring workflow

[kitsuyui]

Summary

Add a weekly monitoring workflow that checks whether GitHub Secret Scanning
push protection is enabled. Push protection prevents secrets from being
committed in the first place; the repository currently has secret scanning
enabled but push protection disabled.

Because enabling push protection requires a repository admin action in
GitHub settings (Settings → Code security → Secret scanning → Push
protection), this PR adds a CI gate that fails with a clear error and a
direct link to the settings page when push protection is not enabled.

Why a monitoring workflow instead of direct enablement

The GitHub API endpoint for enabling push protection requires admin scope.
A workflow using the default GITHUB_TOKEN can only read and verify the
status. The monitoring workflow surfaces the gap as a CI failure,
directing the maintainer to enable it via the repository settings.

Test plan

• Workflow runs on schedule without errors once push protection is enabled
• workflow_dispatch triggers the check manually

[github-actions]

Code Metrics Report

	main (0c91c43)	#118 (4d528b3)	+/-
Coverage	68.3%	68.3%	0.0%
Code to Test Ratio	1:0.1	1:0.1	0.0
Test Execution Time	3s	13s	+10s

Details

  |                     | main (0c91c43) | #118 (4d528b3) | +/-  |
  |---------------------|----------------|----------------|------|
  | Coverage            |          68.3% |          68.3% | 0.0% |
  |   Files             |              4 |              4 |    0 |
  |   Lines             |            550 |            550 |    0 |
  |   Covered           |            376 |            376 |    0 |
  | Code to Test Ratio  |          1:0.1 |          1:0.1 |  0.0 |
  |   Code              |            593 |            593 |    0 |
  |   Test              |             71 |             71 |    0 |
- | Test Execution Time |             3s |            13s | +10s |

---

Reported by octocov