Put the project on GitHub with a safe daily workflow

You are my coding agent working inside this project folder. I am a non-programmer. Explain every git and GitHub word the first time you use it, in one short sentence.

Context: this is the codebase of "Thread & Needle", a fashion e-commerce store. It is a Next.js project with one local git commit. I want it on GitHub with a workflow where the main branch always works and every change goes through a pull request. Read the rules file first and follow it.

Goal: a private GitHub repository, secret protection, an automatic check, and one practice pull request that I approve.

Plan first: show me your plan, including the repository name you propose, and wait for my OK before creating or pushing anything.

Tasks:
1. Check that git has my name and email, and that the default branch is main. Check whether the GitHub command-line tool (gh) is installed. If not, tell me how to install it from its official page, then ask me to run its sign-in command myself in the browser. Never ask me to paste a token.
2. Review .gitignore. It must ignore .env files (but keep .env.example), node_modules, build output and local editor or system files. Search the git history and the tracked files for anything that looks like a key, password or token. Show me what you searched and the result before the first push. If anything is found, stop and tell me.
3. Create a PRIVATE repository named after Thread & Needle (lowercase, with hyphens) and push main to it.
4. Turn on the security features GitHub offers for my account type: Dependabot alerts, and secret scanning with push protection. Secret scanning is free for public repositories; for private ones it may need a paid plan, so say clearly what is and is not available to me and tell me to verify on GitHub's pricing page.
5. Add a GitHub Actions workflow in .github/workflows that runs on every pull request and every push to main: install with a clean install command, then lint, typecheck and build. Give it read-only permissions and no secrets. Use a current Node version that matches my project.
6. Add a short pull request template with: what changed, how I checked it, and a tick-box saying no secrets were added.
7. Write a short CONTRIBUTING section in the rules file: work on a branch named like feat/short-name or fix/short-name, make small commits with clear messages in the present tense, open a pull request, wait for the check to pass, then merge. Never commit straight to main, never force-push, never skip checks.
8. If my plan supports it, set up branch protection so main requires a pull request and the check to pass. If not, tell me and rely on the written rule.
9. Practice: on a new branch, add a README with the store name, what the project is, and how to run it. Commit, push, open a pull request, wait for the check, show me the result, and ask me to approve before you merge. Then delete the branch and update local main.

Security rules: never print, log or commit secrets. If push protection blocks a push, do not bypass it; tell me.

Verify and show me: the repository address, the status of each security feature, the passing check on the pull request, and git log on main.

Report back in this format:
1. Done: what was set up
2. Check: what I should look at on the GitHub website
3. My decisions: anything that needs my choice, such as making the repository public later

Review the prompt, then copy it. Never paste real passwords or API keys into a chat.