mcvs_review: full review of main @ a276963 #71

Full review of main at a276963 (no PR; reviewed against the empty tree).

Findings

Updated for main @ e1ec2fd: #62, #63, #69 and #70 are closed; the dependabot nit is reworded.

• [Should fix] README example pins v0.8.0 and locks itself out with SHA pinning #62 Should fix (pr-reviewer): README example pins v0.8.0 and locks itself out with SHA pinning
• [Should fix] README says to store the admin token as a variable instead of a secret #63 Should fix (pr-reviewer): README says to store the admin token as a variable instead of a secret
• [Should fix] curl calls fail silently and build JSON by hand #64 Should fix (pr-reviewer): curl calls fail silently and build JSON by hand
• [Should fix] Redundant GraphQL branch-protection creation path #65 Should fix (pr-reviewer): Redundant GraphQL branch-protection creation path
• [Should fix] Merge eight gh repo edit steps into one #66 Should fix (pr-reviewer): Merge eight gh repo edit steps into one
• [Should fix] Topics are only added, never removed #67 Should fix (pr-reviewer): Topics are only added, never removed
• [Should fix] Dead locals in main.py branch-protection payload #68 Should fix (pr-reviewer): Dead locals in main.py branch-protection payload
• [Blocking] README layout: add Quickstart and move reference docs to docs/ #69 Blocking (doc-reviewer): README layout: add Quickstart and move reference docs to docs/
• [Should fix] Outdated dependencies #70 Should fix (dependency-reviewer): Outdated dependencies (closed; the remaining types-requests item is the nit below)

Nits

• .gitignore:2: only update-branch-protection-rule.json is ignored; add update-actions-permissions.json and update-actions-selected-actions.json (written by main.py:74,85).
• pyproject.toml:19: types-requests is a dev dependency but requests is never imported. Remove it.
• .github/dependabot.yml (preference, not a CI failure): Dependabot commits use the build(...) type, which lint-commit accepts (build(deps-dev): bump the pip-all group across 1 directory with 4 updates #60). Add commit-message: {prefix: chore} per ecosystem only if chore is preferred.

Clean

• github-actions-reviewer: ✅ all 6 uses: references pinned to full SHAs with exact-release comments.

Generated by mcvs_review 3.1.0 (pr-reviewer, doc-reviewer, dependency-reviewer, github-actions-reviewer) at commit a276963.