feat(sight): production hardening — re-baseline to v0.2.0 + OSS hygiene

[Patel230]

Summary

Production-hygiene pass for sight that brings the repo to top-50 OSS
repository standards. Single commit targeting dev.

The mandate (per GOAL.md) is that sight be the reference Go AI
code-review library for the hawk ecosystem, comparable in quality to
CodeRabbit, Sourcery, DeepSource, Qodana, Semgrep, danger-js, and
reviewbot, and built for solo developers running their coding agent
locally.

This PR re-baselines the version and fills the OSS-meta gaps. No code-
behaviour changes other than the version strings reported via MCP and
SARIF.

Changes

Version 0.2.0

File	Change
mcp/server.go	mcpserver.NewMCPServer("sight", "0.2.0", ...)
sarif.go	Driver.Version + Driver.SemanticVersion → "0.2.0"
internal/output/sarif.go	Driver.Version → "0.2.0" (no SemanticVersion field in this struct)

The SARIF spec version (Log.Version: "2.1.0") is intentionally
unchanged — that field identifies the SARIF format, not the tool.

CHANGELOG.md

Added ## [Unreleased] describing the re-baseline + the new files.
Historical entries (0.4.0 / 0.2.0 / 0.1.0) preserved.

New OSS standard files

File	Purpose
CODE_OF_CONDUCT.md	Contributor Covenant 2.1
.gitattributes	LF normalization, binary detection, linguist hint to collapse go.sum
.editorconfig	UTF-8, LF, tabs for Go + Makefile, 2-space indent for YAML/JSON/TOML, no-trim for Markdown
.github/dependabot.yml	weekly gomod + github-actions, gomod grouped by mark3labs/mcp-go
.github/PULL_REQUEST_TEMPLATE.md	Summary / Changes / Review-quality impact (eval-set numbers) / SARIF compatibility / Testing / Checklist
.github/ISSUE_TEMPLATE/bug_report.yml	surface dropdown (library API / MCP / SARIF / static rules / eval) + dedicated false-positive / false-negative textarea
.github/ISSUE_TEMPLATE/feature_request.yml	kind selector covering 8 functional areas + solo-dev fit checks
.github/ISSUE_TEMPLATE/config.yml	routes security to advisories, questions to discussions, blocks blank issues

The PR template has two sight-specific sections:

• Review-quality impact — every change to reviewer.go,
  multi_concern.go, filter.go, static_rules.go,
  convention_check.go, or internal/review/ can shift the
  false-positive / false-negative balance, so the template asks for
  before/after eval-set numbers.
• SARIF compatibility — every change to sarif.go or
  internal/output/sarif.go must still validate against the SARIF
  2.1.0 schema.

Cleanup

• gofmt -w on sarif.go and internal/output/sarif.go to fix
  pre-existing struct-tag alignment drift in the files I touched.

Verification

Check	Status
go build ./...	✅ clean
go vet ./...	✅ clean
go test -race -count=1 -timeout=120s -short ./...	✅ all 7 packages pass: root sight, internal/{comment,context,diff,output,review}, mcp
gofmt -l for files I touched	✅ clean

Test plan

• make build
• make test-race
• go vet ./...
• gofmt -l mcp/server.go sarif.go internal/output/sarif.go empty
• CI on this PR will run lint (govet, ineffassign, nilerr,
  misspell per .golangci.yml) and tests