Add CONTRIBUTING.md explaining the cligentic copy-paste registry pattern

[Railly]

Context

Foundation primitives under src/cli/ are cligentic blocks pulled via bunx shadcn add; fixes belong upstream in Railly/cligentic, not hand-edits here. A new contributor cannot intuit that.

Task

Add CONTRIBUTING.md: what is safe to edit locally (src/commands/, src/lib/) vs what goes upstream first (src/cli/foundation|agent|safety|platform).

Acceptance criteria

Doc merged and linked from README.

[slegarraga]

Happy to take this one. I will add CONTRIBUTING.md explaining the cligentic copy-paste registry pattern and link it from the README.