docs: add community maintenance foundation

[LeemanCheung]

Summary

• add a security policy with private-reporting guidance and explicit runtime data boundaries
• add a contribution guide aligned with the pinned DSH toolchain and existing CI gates
• add a fact-based changelog for versions 0.1.0 through 0.3.0 and the current unreleased fix
• add structured bug/feature issue forms and a pull request checklist
• link the new maintenance resources from the README
• remove two one-shot workflows explicitly marked temporary and scoped to an old feature branch

Verification

• all three Issue Form YAML files parse successfully
• local README/document targets exist
• npm pack --dry-run --json still contains the expected 41-file package payload
• git diff --check passed
• documentation was independently reviewed for unsupported promises, version/date accuracy, and executable setup instructions

Boundaries

This change does not claim user counts, production adoption, legal compliance, or response-time guarantees. It does not modify runtime code or loosen CI.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T03:36:09.959748Z	8a3f19e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.