chore: sync workspace metadata and docs

.gitignore

@@ -15,3 +15,6 @@ hawk
 .gocache/
 *.codegraph.db
 .DS_Store
+
+# Test artifacts
+coverage.out

CHANGELOG.md

@@ -90,9 +90,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `lint`, `fmt`, `vet`, `security`, `bench`, `clean`, `install`, `release`, `help`.
 - **Container**: Dockerfile uses `tini` init, embeds tzdata, verifies deps, runs as
   non-root.
-- **Repository hygiene**: `.editorconfig` for cross-editor consistency,
-  `.github/dependabot.yml` for automated dep updates, `CONTRIBUTING.md` with the
-  full contributor workflow.
+- **Repository hygiene**: `.editorconfig` for cross-editor consistency and
+  `CONTRIBUTING.md` with the full contributor workflow.
 
 ### Fixed — Correctness
 - 240+ unchecked error returns hardened across `session`, `engine`, `tool`, `config`,

SECURITY.md

@@ -44,8 +44,8 @@ We follow [coordinated vulnerability disclosure](https://en.wikipedia.org/wiki/C
 
 ## Security practices in this repo
 
-- **Dependency monitoring:** automated via Dependabot (see
-  `.github/dependabot.yml`).
+- **Dependency monitoring:** vulnerable dependencies are detected by
+  `govulncheck`, which runs on every CI build (see "Vulnerability scanning").
 - **Static analysis:** `golangci-lint` / `ruff` / `mypy` enforced in CI.
 - **Vulnerability scanning:** `govulncheck` (Go) / `pip-audit` (Python) run
   on every CI build.

cmd/trace.go

@@ -1,7 +1,7 @@
 package cmd
 
 import (
-	tracecli "github.com/GrayCodeAI/trace/cmd/trace/cli"
+	tracecli "github.com/GrayCodeAI/trace/cli"
 )
 
 // trace is a sibling library consumed by hawk, not a standalone product. Its full