Add org-wide community health defaults

[EllAchE]

Summary

Why: an outside contributor arriving at the benchmark or powhttp-mcp today has no stated way to contribute and — worse — no private channel to report a vulnerability, so the rational move is to file it as a public issue. An org-wide code search returns 0 results for CONTRIBUTING.md and CODE_OF_CONDUCT.md, and only string-ai-mcp has a SECURITY.md.

Now that .github exists (S-130225), files placed here are inherited by every org repo lacking its own, so this is one PR instead of five — and it covers repos that don't exist yet.

What changed — six new default files plus a README update:

File	Why it's here
SECURITY.md	The one that actually matters. Routes disclosure to support@usestring.ai privately, and scopes to the hosted services too (request./mcp./portal.usestring.ai), not just the repos.
CONTRIBUTING.md	Bug fix → just send the PR; anything larger → issue first, because several repos have constraints invisible from outside (provider rate limits, fingerprints that break on header reordering).
CODE_OF_CONDUCT.md	Conduct expectations and a named enforcement contact.
SUPPORT.md	Routing, so account/billing/key questions go to email instead of a public issue.
.github/PULL_REQUEST_TEMPLATE.md	Prompts for why, not just what.
.github/ISSUE_TEMPLATE/	Bug + feature forms and config.yml contact links.

Nothing here is invented. The security address is the one already in string-ai-mcp/SECURITY.md — I reused it rather than minting a security@, which would bounce. The contribution conventions (squash merge, Conventional Commits PR titles driving the version bump) are lifted from powhttp-mcp's own README, where release automation already depends on them. The benchmark's "start with --attempts 1" warning comes from its README's own Notes section.

Two GitHub rules that shaped the layout, both verified against the docs rather than assumed:

• ISSUE_TEMPLATE/ is all-or-nothing. If a repo has anything in its own .github/ISSUE_TEMPLATE/, GitHub ignores this whole directory for that repo instead of merging. Every other file overrides individually. No repo currently has one, so all five inherit.
• A LICENSE cannot be defaulted — GitHub excludes it deliberately, since the license must travel with the code when a repo is cloned or packaged. So licenses stay per-repo; the benchmark's is S-130238 / web-data-frontier-benchmark#7. Worth stating in the README so nobody tries to centralise it later.

Also: this only works while .github stays public. A private default-files repo is unsupported, which is now documented in the README.

Judgement calls, flagged rather than buried:

1. The Code of Conduct is short and original, not the Contributor Covenant. I did not want to reproduce quasi-legal boilerplate from memory and risk subtle divergence from the canonical text. It links the Covenant as the standard longer treatment and states no conflict is intended. If you'd rather have the recognised document — GitHub's community profile detects it — swap in the canonical 2.1 text and I'll do that as a one-file follow-up.
2. blank_issues_enabled: true. Forcing everyone through a form produces worse issues than letting people describe something that doesn't fit one.
3. No FUNDING.yml — a commercial company soliciting sponsorship would read oddly.
4. string-ai-mcp keeps its own SECURITY.md and is unaffected by this PR. Its content is narrower than this one (no service scope, no API-testing guidance), so consider deleting it later to inherit the org default; not doing that here since it's a different repo.

Test plan

• All three issue-form YAML files parse, and validate structurally: every non-markdown block has an id, every block type is one GitHub accepts, the dropdown has options, both forms have the required name + description, and all four contact_links have name/url/about.
• Verified against GitHub's docs that every file added is on the supported-defaults list, and that root placement is valid for the four prose files while ISSUE_TEMPLATE/ must live under .github/ (it does).
• Confirmed .github is public, which the inheritance requires.
• Cross-checked the security address against string-ai-mcp/SECURITY.md — no new address introduced.
• Relative links between the new files (SECURITY.md ↔ CONTRIBUTING.md ↔ SUPPORT.md) all resolve within this repo; the PR template uses absolute URLs since it renders in other repos where a relative path would 404.
• After merge: open a new issue in web-data-frontier-benchmark and confirm the inherited forms and contact links appear, and that the PR template body prefills there.

Fixes S-130242

Agent Audit

• Action: create-pr
• Timestamp: 2026-07-26T04:43:41Z
• Agent: claude
• Agent type: claude
• Triggered by: loganharless
• Origin: loganharless@MacBook-Pro-5
• Session: cfdf9d1b-6e78-4093-b4eb-df6443125ac5
• Source repo: usestring/.github
• Worktree: /Users/loganharless/Desktop/da/worktrees/usestring-community-health-20260726-004049
• Branch: s-130242-community-health-defaults-20260726-004049
• Head commit: 46ed8c3
• tmux pane: %805
• tmux session: apc-12518-11403