v1.9.4 — CONTRIBUTING.md

What's new

Added CONTRIBUTING.md following a review of this project's git practices against industry standards.

The review found: tagging, releases, and CHANGELOG discipline are already solid. Direct commits to `main` are a deliberate, legitimate choice for a solo-maintained project — not something that needed fixing. The actual gap was that issue templates invited bug reports and feature requests, but nothing told an outside contributor how to submit an actual code change.

CONTRIBUTING.md now covers: fork/branch/PR process, running the test suite first, updating CHANGELOG under `[Unreleased]`, code style expectations, and licensing (GPL v3).

Also added a "Contributing" section to the README linking both CONTRIBUTING.md and SECURITY.md (which wasn't linked from the README before).

See CHANGELOG.md for full history.