chore(repo): establish repository foundation

[back1ash]

Closes #1

Summary

• establish the develop integration and main release workflow
• add contributor, governance, security, conduct, and support guidance
• add structured bug, feature, and technical-spike issue forms
• add a pull request template, roadmap, changelog, and ADR workflow
• assign default review ownership to @back1ash through CODEOWNERS
• add the required repository-validation GitHub Actions check
• document the pre-alpha product boundary without selecting a product runtime or validator

Why

PROOF needs a predictable open source contribution and decision process before implementation choices are made. This foundation keeps normal changes issue-driven and directed to develop, preserves main for releases, and gives maintainers reproducible repository checks for review decisions.

User and contributor impact

Contributors can now identify where to propose work, how to branch and open pull requests, how releases and hotfixes flow, how to report security issues, and which technical decisions remain intentionally open. Protected branches require CI and resolved conversations. The minimum approving-review count is temporarily zero until the repository owner enables it after the foundation is ready. No product runtime behavior changes because no implementation exists yet.

Validation

• local repository validation passed across 23 text files
• valid topic, release, fork-contribution, hotfix-sync, and Dependabot scenarios exercised
• spoofed release branches, Dependabot impersonation, invalid targets, and invalid PR titles rejected
• git diff --cached --check
• GitHub Actions repository-validation completed successfully
• actions/checkout pinned to the official v7.0.1 commit SHA with persisted credentials disabled

Repository settings applied

• default branch: develop
• active main and develop rulesets: PR required, zero required approvals during bootstrap, resolved conversations, strict required CI, no force push, no deletion, and no standing bypass
• squash merge and merge commit enabled; rebase merge disabled
• merged topic branches deleted automatically
• Dependabot alerts and security updates enabled
• secret scanning, push protection, and Private vulnerability reporting enabled

Deferred decisions

• product runtime, package manager, monorepo tooling, and OpenAPI validator

• product build, unit, integration, and security test jobs after the runtime decision

• final product name