Add contributor, security, and GitHub community documentation

[MPIsaac-Per]

Goal

Make the project safer and easier for external contributors to understand and improve.

Deliverables

• CONTRIBUTING.md with setup, architecture, TDD, typecheck, test, and PR expectations
• SECURITY.md with a private vulnerability-reporting path and the unattended-runtime threat model
• GitHub issue forms for bugs and feature requests
• Pull-request template with test/typecheck checklist
• Documentation for the serial-execution hard constraint

Acceptance criteria

• Security reports are directed away from public issues.
• Contributor instructions match the actual package scripts and repository constraints.
• Templates do not request secrets, tokens, private prompts, or issue contents.
• New contributors can identify and run the required verification command.

---

Linear execution plan

GitHub remains the public source of truth. Private prioritization, dependencies, and agent execution are tracked in the Linear Agent Bridge OSS project.

Parent: MPI-1445

• MPI-1446 — Document contribution workflow and private security reporting
• MPI-1447 — Add GitHub issue forms and a pull request template

Implementation tickets are labeled agent-ready in Linear and include scope, acceptance criteria, dependencies, repository constraints, and required verification evidence. Public decisions and completion status should be mirrored back to this issue.