Harden repository governance and security configuration

[DenWin]

Parent: #31. Coordinate with documentation epic #24 and CI issue #32.

Current gaps

The repository has basic issue templates and SECURITY.md, but no CONTRIBUTING.md, CODEOWNERS, pull-request template, architecture/docs ownership, documented branch protection, release governance, or comprehensive dependency/security policy.

Required work

• Add CONTRIBUTING.md and pull-request template through Create contributor, development, and testing documentation #27.
• Add CODEOWNERS for sensitive areas such as workflows, Dockerfile, auth, storage, migrations, and security policy.
• Configure protected main branch:
  • required pull request
  • required current checks
  • conversation resolution
  • no force push/deletion
  • restricted bypass
• Require review for workflow and security-sensitive changes.
• Enable secret scanning/push protection, dependency graph/alerts, and private vulnerability reporting where available.
• Define supported versions and security response expectations in SECURITY.md.
• Define release authority, tag protection, versioning, changelog, and rollback policy.
• Reconcile conventional-label action output with release.yml label names/casing.
• Add issue-template configuration and security/contact routing.
• Add license/package metadata and repository metadata where missing.
• Define bot permissions and Renovate automerge boundaries.
• Add stale/archival policy only if maintainership needs it; do not automate closure blindly.
• Document fork/upstream contribution policy.

Acceptance criteria

• Sensitive paths have explicit review ownership.
• Main and release tags are protected.
• Required checks match actual workflow names.
• Security reporting/scanning settings are verified.
• Release and dependency automation has least-privilege rules.
• Governance documentation matches configured GitHub settings.