feat(inspect): production hardening — re-baseline to v0.2.0 + OSS hygiene

[Patel230]

Summary

Production-hygiene pass for inspect that brings the repo to top-50 OSS
repository standards. Single commit targeting dev.

The mandate (per GOAL.md) is that inspect be the reference Go
website + dependency security scanner for the hawk ecosystem,
comparable in quality to gosec / trivy / snyk / grype / osv-scanner /
bearer / gitleaks / trufflehog / checkov / tfsec, and built for solo
developers running their coding agent locally.

This PR re-baselines the version (also fixes a small inconsistency
between two version strings) and fills the OSS-meta gaps. No code-
behaviour changes other than the version strings reported via MCP and
SARIF.

Changes

Version 0.2.0 (also: fix internal inconsistency)

File	Change
internal/report/sarif.go	const inspectVersion = "0.2.0" (was "1.0.0", used as tool.driver.version in SARIF)
mcp/server.go	mcpserver.NewMCPServer("inspect", "0.2.0", ...) (was "0.1.0")

Pre-PR these two strings disagreed (1.0.0 vs 0.1.0); now they both
report 0.2.0. The SARIF spec version (sarifVersion = "2.1.0")
is intentionally unchanged — different field, identifies the format
not the tool.

The CVE-database entries in dependency_check.go (e.g. 0.0.0-2022
for golang.org/x/crypto, 4.17.20 for lodash, etc.) are factual
CVE-affected/fixed versions of third-party libraries — left untouched.

CHANGELOG.md

Added ## [Unreleased] describing the re-baseline + the new files.
Historical entries (0.4.0 / 0.2.0 / 0.1.0) preserved.

New OSS standard files

File	Purpose
CODE_OF_CONDUCT.md	Contributor Covenant 2.1
.gitattributes	LF normalization, binary detection, linguist hints to collapse go.sum and browser/go.sum
.editorconfig	UTF-8, LF, tabs for Go + Makefile, 2-space indent for YAML/JSON/TOML, no-trim for Markdown
.github/dependabot.yml	weekly gomod (root + browser/ sub-module grouped by go-rod) + github-actions, root gomod grouped by mark3labs/mcp-go
.github/PULL_REQUEST_TEMPLATE.md	Summary / Changes / Scan-quality impact / SARIF compatibility / SSRF & egress safety / Testing / Checklist
.github/ISSUE_TEMPLATE/bug_report.yml	surface dropdown (library API / MCP / GitHub Action / SARIF / browser checks / CVE database) + false-positive textarea
.github/ISSUE_TEMPLATE/feature_request.yml	kind selector covering 8 areas + solo-dev fit checks (with explicit "does not weaken SSRF / egress protections" confirmation)
.github/ISSUE_TEMPLATE/config.yml	routes security to advisories, questions to discussions, blocks blank issues

The PR template has three inspect-specific sections:

• Scan-quality impact — every change to checks, the crawler, the
  rule set, or finding deduplication can shift the false-positive /
  false-negative balance.
• SARIF compatibility — every change to internal/report/sarif.go
  must still validate against the SARIF 2.1.0 schema.
• SSRF & egress safety — inspect crawls user-supplied URLs, so
  any change to private-IP blocking, redirect filtering, scheme
  allowlists, or DNS resolution must be called out explicitly. This
  mirrors the does not weaken SSRF / egress protections checkbox in
  the feature-request template.

Cleanup

• gofmt -w on mcp/server.go and internal/report/sarif.go to fix
  pre-existing blank-line and struct-tag alignment drift in the files
  I touched.

Verification

Check	Status
go build ./...	✅ clean
go vet ./...	✅ clean
go test -race -count=1 -timeout=120s -short ./...	✅ all 6 packages pass: root inspect, checks, internal/{check,crawler,report}, mcp
gofmt -l for files I touched	✅ clean

Test plan

• make build
• make test-race
• go vet ./...
• gofmt -l mcp/server.go internal/report/sarif.go empty
• CI on this PR will run lint (govet, ineffassign, misspell
  per .golangci.yml) and tests
• browser/ sub-module is not exercised here (requires Chromium);
  separate workflow handles it