Prepare the repository for public release

[luhe19001]

Summary

• harden the loopback server against DNS rebinding and cross-site browser requests, including Origin and Referer fallback validation
• add public-release hygiene: root ignores, MIT package metadata, third-party attribution, Dependabot, private security reporting, and sanitized bug intake
• define a maintainer-led, invitation-only contribution policy and remove contributor-growth templates

Why

The local API can read agent session data and launch terminals, so publishing the repository requires explicit browser-request boundaries and clear security, licensing, and maintenance expectations.

Verification

• Gitleaks v8.30.1 scanned 65 commits reachable from upstream refs: no leaks
• Gitleaks worktree scan: no leaks
• go test ./...: passed
• go vet ./...: passed
• npm run lint: passed with two existing Fast Refresh warnings
• npm test: 7 tests passed
• npm run build: passed
• release UI returned 200 on 127.0.0.1, localhost, and custom port 8790
• Vite proxy API returned 200; invalid Host, cross-site Fetch Metadata, and cross-origin fallback headers returned 403

Known check

npm run format:check still reports the unchanged src/pages/coslash/CoslashPage.tsx; this PR does not modify that file.