Add issue templates that route disclosure away from public threads

[stxkxs]

Closes the last open item from the 2026-08-18 sweep that was mine to close. The repo is public with issues enabled and had no templates — so the default path for a reporter was a blank public issue, including for the one class of report that must never be filed publicly.

The actual problem

SECURITY.md and CONTRIBUTING.md already say that anything touching provenance or personal data goes through a private advisory. That only works if the reader finds it before filing. Nothing enforced it at the moment of filing.

These templates move the rule to the point of decision — the redirect now appears before someone can paste a finding into a public thread.

What's here

config.yml — blank_issues_enabled: false, plus two contact links above the form:

Route	Why
Private security advisory	Forged/missing citation, wrong retrieved_at, or personal data. Worded for this product's real threat surface, not generic "found a vuln".
Upstream data issue	"The government source published something wrong" is a coverage caveat, not a citature bug — and a reporter has no way to know that in advance.

bug.yml — opens with the stop-and-report-privately notice repeated, on the assumption the reporter skipped the contact links. Fields are shaped around how this product actually fails:

• tool/actor · exact input · expected vs actual
• the receipt envelope — optional, but the most useful field on the form. The citation, retrieved_at, and match provenance name the upstream file the answer came from, which is usually the shortest path to a cause.
• a source dropdown (FEC / USASpending / SAM.gov / Grants.gov), because those have genuinely different upstream cadences — a report that looks like staleness is often correct behaviour on FEC's two-year publication cycle.

The input field explicitly says to redact nothing: these are public records by law, so a redacted repro is harder to act on for no privacy gain.

Verification

• Both YAML files parse.
• The advisory URL resolves anonymously (200), so the link check won't flag it and a logged-out reporter won't hit a wall.

Reach

Same limit as the other health files, and stated for the same reason: GitHub applies .github defaults to public repositories, and the org's only other repo is private. Immediate reach is this repository.