docs: add CONTRIBUTING and CODE_OF_CONDUCT

[BunsDev]

Adds the two governance documents the repository still lacks before a public release. Documentation only — no source, build, workflow, or lock-pinned file is touched.

Rescoped. This PR originally also added LICENSE, SECURITY.md, and a README.md section. #63 carries those, so keeping them here too would guarantee a merge conflict between two of my own PRs. They have been dropped. This PR is now exactly two new files and conflicts with nothing.

What this adds

File	Contents
CONTRIBUTING.md	Setup, branch and PR conventions, the signed-commit requirement, verification commands, Biome style, the conformance-lock repin process, security-sensitive areas
CODE_OF_CONDUCT.md	Standards, scope, private reporting, a proportionate enforcement ladder

Before this change the repository had neither.

These are written against this repository, not dropped from a template

• The real toolchain: Node 22+, pnpm 10.34.0 via Corepack, rust-toolchain.toml, Tauri prerequisites.
• The real script names: typecheck, lint, test, build, cargo:fmt, cargo:clippy, cargo:test, test:e2e — each verified against package.json.
• The real branching convention, including git worktree add -b <type>/<short-name> .worktrees/<short-name> origin/main.
• The signed-commit requirement, with the pre-flight user.signingkey / gpg.format checks and the git log -1 --show-signature confirmation, because a silently-failed signature is easy to miss until the commit is already pushed.
• An honest description of the conformance lock: that phase1-conformance.lock.json pins the Rust host, scripts/, ci.yml, and client-v1-conformance.yml; that touching any of them requires the two-commit repin including docs/phase1-conformance.md and src/phase1-conformance-lock.test.ts; and that a contributor who is unsure should say so in the PR rather than repin speculatively. This is the single most likely way for a well-meaning outside contribution to break the build, and it was undocumented.
• A list of security-sensitive areas — the Tauri capability set, native commands, keyring and pairing code, release automation — with the note that "it would be convenient" is not sufficient justification for widening the native surface.

CODE_OF_CONDUCT.md adapts the Contributor Covenant 2.1 principles and enforcement ladder, with attribution, and routes reporting through GitHub's report control plus a private channel.

Verification

• git log -1 --show-signature → good signature; commit shows as Verified.
• Branched from origin/main at 77ba6ae.
• The diff is exactly two added files. No src/, src-tauri/, scripts/, .github/, or *.lock.json path is touched.
• pnpm lint is unaffected: Biome does not lint Markdown, and neither file is in the lint script's path list.

CI status

This PR is red, and not because of anything in it. A docs-only change reproduces the failure, which is how it was isolated:

• Changed paths correctly classified it as docs-only and skipped E2E, Desktop build, Contract canary, and Phase 1 conformance.
• Web checks still fails, in pnpm test:unit, at phase1-conformance-lock.test.ts and phase1-conformance.test.ts with Error: Command failed: git merge-base.

Resolved. The branch was cut from 77ba6ae, which still carried the old lock pinning b49cebc6, the pre-squash head of #57's branch. That commit stopped being reachable from main the moment #57 was squash-merged, so git merge-base failed on a fresh CI clone. #60 (4dc8f64) had already repinned main to a reachable revision; the branch simply predated it.

Rebasing onto 4dc8f64 fixes it, and this was confirmed rather than assumed: run 33485095922 is completed/success — Web checks=success, Contract canary=success, everything else correctly skipped for a docs-only diff.

Follow-up

Once #63 lands, README.md should gain links to LICENSE, SECURITY.md, CONTRIBUTING.md, and CODE_OF_CONDUCT.md. Left out of this PR deliberately so the two branches do not both edit the end of the README.

[Copilot]

Pull request overview

Adds a standard repository governance/documentation set needed for a public release (license, security policy, contributing guide, and code of conduct), plus README links to those documents.

Changes:

• Add LICENSE (MIT) for the repository.
• Add SECURITY.md, CONTRIBUTING.md, and CODE_OF_CONDUCT.md with project-specific guidance.
• Append new “Contributing / Security / License” sections to README.md linking to the new docs.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
SECURITY.md	Introduces security reporting/scope guidance and security-relevant design notes.
README.md	Adds links to the new governance/security/license documents.
LICENSE	Adds MIT license text and copyright notice.
CONTRIBUTING.md	Documents local setup, tooling, workflow conventions, and verification commands.
CODE_OF_CONDUCT.md	Establishes community standards and reporting/enforcement process.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[BunsDev]

Rebased once more onto current main (now includes #88's harness-authority repin). Typecheck/lint/format clean. Pushed.