Update public release documentation

Author: itresfall

CHANGELOG.md

@@ -61,6 +61,13 @@ unless `ROAD_VERSION` is set during build.
   ROAD zip/checksum files before creating the current version artifacts.
 - Added GitHub Actions CI for tests, Windows build smoke, Linux build smoke, and
   tag-based release package artifacts.
+- Updated GitHub Actions to the Node 24 action generation
+  (`actions/checkout@v6`, `actions/setup-go@v6`, and
+  `actions/upload-artifact@v7`) and disabled Go cache restore to avoid noisy
+  toolchain cache warnings.
+- Added public repository hardening after publication: Dependabot security
+  updates, secret scanning, secret scanning push protection, delete-branch-on-
+  merge, and `main` branch protection with required CI checks.
 - Added repository QA tests that load real config JSON files and built-in plugin
   profiles.
 - Split the interactive `cmd/road` entrypoint into focused menu, server flow,

docs/PUBLIC-READINESS-AUDIT.md

@@ -79,15 +79,21 @@ Fix: packaging now removes existing `road-proxy-v3_*.zip` and matching `.sha256`
 - `trust_proxy_headers=true` is safe only behind Cloudflare or another trusted reverse proxy. Direct exposure with spoofable proxy headers is not supported.
 - UDP compatibility remains game-dependent. ROAD can prove transport behavior with `udp-check`, DDNet, and Sven Co-op baselines, but games that embed peer addresses or rely on official Steam/EOS relay traffic may still need protocol-specific work.
 - Windows arm64 builds are produced as experimental artifacts and still need runtime testing on real hardware.
-- GitHub Release publishing should be verified after tag CI runs in the private repo before flipping visibility to public.
+- GitHub Release publishing was verified from tag CI before public release.
+- GitHub repository hardening was applied after publication: Dependabot security
+  updates, secret scanning, secret scanning push protection, delete-branch-on-
+  merge, and `main` branch protection with required CI checks.
 
 ## Public Readiness Verdict
 
-Ready for a private final release run and GitHub Release verification.
+Published as a public repository after final CI, release asset, and repository
+security verification.
 
-Do not make the repository public until:
+Publication checks completed:
 
 1. `go test ./...`, `go vet ./...`, config validation, and release packaging pass after the final commit.
 2. The `v0.1.0` tag workflow creates GitHub Release assets successfully.
 3. The GitHub Release page contains zip + sha256 assets for Windows amd64, Windows arm64 experimental, Linux amd64, and Linux arm64.
-4. Repository visibility, Issues, Discussions, and private vulnerability reporting settings are set intentionally.
+4. Repository visibility, Issues, Projects, Wiki, and security settings are set intentionally.
+5. `main` branch protection requires `Go Test`, `Linux Build Smoke`, and
+   `Windows Build Smoke` before merge.