Add CLI community health and governance

[malik111110]

Summary

• add contributor setup, test, pull-request, rule, fixture, and DCO guidance
• publish supported-version, private reporting, response-target, and coordinated-disclosure policy
• separate community help, bugs, false positives, security, and commercial support channels
• define maintainer roles, decision rules, merge authority, and release authority
• add structured forms for bugs, false positives, rule requests, feature requests, and questions
• add a pull-request checklist for tests, noise/benchmark impact, security, privacy, and DCO sign-off
• link the community entry points from README
• enable GitHub private vulnerability reporting for the public repository

Why

The public CLI had a Code of Conduct but no actionable contribution, security, support, or governance path. Blank public issues also made it easy to disclose sensitive details or omit the fixture and noise evidence needed to review scanner changes.

Validation

• parsed and structurally checked all six issue-template YAML files
• verified every local Markdown link
• verified public GitHub, DCO, release, advisory, and website URLs return HTTP 200
• verified patchflow.dev publishes an MX record for the existing conduct address
• confirmed private vulnerability reporting is enabled via GitHub API
• gofmt clean
• go mod tidy stable; direct pflag usage is now classified correctly
• go vet ./...
• CI-equivalent non-integration test suite
• go build ./...
• commit carries the documented DCO sign-off

Remaining closure evidence

After merge, create and close one harmless test issue through the new issue chooser, verify each rendered form on the default branch, and confirm delivery to the existing Code of Conduct address. Those default-branch checks cannot be completed from a pull-request branch.

Refs #4

[malik111110]

@coderabbitai review

[malik111110]

CI dependency confirmed:

• Ubuntu and macOS pass on this documentation-only branch.
• PatchFlow Security Scan fails because main emits SARIF without the required executionSuccessful property.
• Windows fails on the existing HOME/path normalization, manifest separator, and traversal cases from main.
• PR chore: make public repository canonical #10 already fixes both classes of failure and is fully green on Ubuntu, macOS, Windows, self-scan, release dry-run, and the required PatchFlow CLI check.

This PR intentionally does not duplicate those functional fixes. Merge #10 first, then update this branch from main and rerun the checks. The local documentation/community validation remains green.

[malik111110]

Self-review completed: community files cover every acceptance item in #4; issue-form YAML, local Markdown links, public endpoints, private vulnerability reporting, DCO sign-off, gofmt, go mod tidy, vet, tests, and build were verified. No documentation-scope change is requested. Remote Windows and SARIF failures are pre-existing main defects already fixed and green in #10. Another maintainer must provide the required approval.