ci: minimal scope — fix install, lint+tests only, Dependabot alerts-only

- pyproject: PEP 639 license string + setuptools>=77 (fixes editable install
  failure 'project.license must be string' that was breaking ALL CI)
- CI reduced to two jobs: Lint (ruff check + format) and Tests (3.13) (unit)
- remove security-scan and release-please workflows (noise / not needed now)
- remove dependabot.yml (no automated dependency PRs)
- Dependabot: vulnerability alerts ON (Security tab), automated fixes OFF
- docs updated to match

Co-Authored-By: claude-flow <ruv@ruv.net>

Author: bhavik-shyftlabs

.github/dependabot.yml

@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   lint:
-    name: Lint & type-check
+    name: Lint
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -27,27 +27,23 @@ jobs:
         run: |
           python -m pip install --upgrade pip
           pip install -e ".[dev]"
-      - name: Ruff (lint)
+      - name: Ruff lint
         run: ruff check .
-      - name: Mypy (type-check)
-        run: mypy src/orchestrator
+      - name: Ruff format check
+        run: ruff format --check .
 
   test:
-    name: Tests
+    name: Tests (3.13)
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        python-version: ["3.13"]
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with:
-          python-version: ${{ matrix.python-version }}
+          python-version: "3.13"
           cache: pip
       - name: Install
         run: |
           python -m pip install --upgrade pip
           pip install -e ".[dev]"
-      - name: Pytest (unit, no external services)
-        run: pytest -m "not integration and not e2e and not live_mcp" --cov=orchestrator --cov-report=xml -n auto
+      - name: Unit tests
+        run: pytest tests/unit -q

.github/workflows/ci.yml

@@ -11,11 +11,10 @@ and Continuum adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.ht
 - GitHub issue templates (`bug.yml`, `feature.yml`, `question.yml`) and a chooser config that disables blank issues and routes security reports to a private advisory.
 - Pull request template with Conventional-Commits typing, DCO checkbox, and lint/type/test gates.
 - `CODEOWNERS` for automatic review routing.
-- Dependabot configured for security-only updates (`pip`, `github-actions`); routine version-bump PRs are disabled.
+- Dependabot vulnerability **alerts** (surfaced in the Security tab); automated dependency PRs are disabled.
 - `MAINTAINERS.md` with the current maintainer list, tone rules, and escalation path.
 - `SECURITY.md` with the private disclosure channel and severity SLAs.
-- CI workflow (`ruff`, `mypy`, `pytest`) and security scan workflow (`gitleaks`, `pip-audit`, `bandit`).
-- `release-please` workflow for automated version bumps and changelog updates.
+- Minimal CI workflow: ruff lint + format check and unit tests on `main`/`dev`.
 
 ### Changed
 - _Nothing yet._

.github/workflows/release-please.yml

@@ -47,14 +47,14 @@ Both `main` and `dev` are protected. Configure under **Settings → Branches →
 | Required approving reviews | 1 (from a maintainer) | 1 |
 | Dismiss stale approvals on new commits | ✅ | ✅ |
 | Require status checks to pass | ✅ | ✅ |
-| Required checks | `Lint & type-check`, `Tests (3.13)`, `Secret scan (gitleaks)` | same |
+| Required checks | `Lint`, `Tests (3.13)` | same |
 | Require branches up to date before merging | ✅ | ✅ |
 | Require signed-off commits (DCO) | ✅ | ✅ |
 | Require linear history | ✅ | ✅ |
 | Restrict who can push | maintainers only | maintainers only |
 | Allow force pushes / deletions | ❌ | ❌ |
 
-`pip-audit` and `bandit` run as **advisory** checks (non-blocking) — review their output, but they will not gate a merge. Direct pushes to `main`/`dev` are disabled; all changes land through PRs.
+Security is handled out of band, not as a gating check: Dependabot vulnerability **alerts** surface in the **Security** tab (no automated PRs). Direct pushes to `main`/`dev` are disabled; all changes land through PRs.
 
 ## Commit messages
 

.github/workflows/security.yml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["setuptools>=68.0", "wheel"]
+requires = ["setuptools>=77.0", "wheel"]
 build-backend = "setuptools.build_meta"
 
 [project]
@@ -8,7 +8,7 @@ version = "0.2.0"
 description = "Agentic Framework for Enterprise-Wide Execution with multi-LLM provider support, observability, and error tracking"
 readme = "README.md"
 requires-python = ">=3.13"
-license = {text = "Apache-2.0"}
+license = "Apache-2.0"
 license-files = ["LICENSE", "NOTICE"]
 authors = [
     {name = "Bhavik Ardeshna", email = "continuum@shyftlabs.io"}
@@ -26,7 +26,6 @@ keywords = [
 classifiers = [
     "Development Status :: 3 - Alpha",
     "Intended Audience :: Developers",
-    "License :: OSI Approved :: Apache Software License",
     "Programming Language :: Python :: 3",
     "Programming Language :: Python :: 3.13",
     "Topic :: Software Development :: Libraries :: Python Modules",