Bootstrap contributor and repository workflows

[ak5]

Summary

• add contributor, documentation, and repository-convention entry points
• align Codex, Claude, and Copilot guidance around the credential boundary
• add issue/PR workflows, CODEOWNERS, staged-release validation, and repo-local operator skills

Security impact

• Trust boundary changed: no
• Credential flow changed: no
• Threat model update: not required; this change documents existing behavior and repository policy

Documentation

• adds the canonical docs index, ownership map, contribution policy, and bootstrap record

Verification

• mise run check
• YAML parse validation
• relative Markdown link validation
• branch-path acceptance/rejection cases
• byte-identical AGENTS.md and CLAUDE.md

Risk and rollback

• Risk: branch-path policy or contributor guidance could reject an intended exceptional PR path
• Rollback: revert this commit; GitHub settings are independently reversible

Deferred

• advanced non-provider and validity secret scanning remained disabled by GitHub on the current plan
• the new branch-path status check is intentionally not required until it succeeds on this PR