[Feature] No CODEOWNERS or CONTRIBUTING.md and GitHub private vulnerability reporting is disabled, so the security template points at a SECURITY.md that never existed and a finder has no private channel

[pathosDev]

Use case

Scope note first, because half of this is already tracked: SECURITY.md itself belongs
to #539, which is open and lists it as the first deliverable ("Quick win, land first").
#617 raised it independently and was closed NOT_PLANNED with a duplicate label,
pointing at #539. This issue covers the parts that neither of them owns, plus one fact
that has not been recorded anywhere: GitHub private vulnerability reporting is
switched off, so the fallback the security template offers does not exist either.

The template hedges, and the hedge is the whole problem:

.github/ISSUE_TEMPLATE/security_report.yml:11-17
        > ⚠️ **For pre-disclosure handling**, please first check
        > the project's security policy in `SECURITY.md` (or, if
        > absent, contact the maintainer privately).  Use this
        > public template for findings you're OK discussing in the
        > open — e.g., audit follow-ups, defense-in-depth items
        > that don't fit the responsible-disclosure window.

"Contact the maintainer privately" names no channel. There is no SECURITY.md, no email
address in the repository, and — the new part — the GitHub feature that would otherwise
provide the channel is disabled:

$ gh api repos/pathosDev/actor-ts/private-vulnerability-reporting
{"enabled":false}

With that off, GitHub renders no "Report a vulnerability" button on the Security tab and
links no policy. So a finder of an unfixed, remotely-exploitable defect in a published
package has exactly two options: open a public issue that discloses it to everyone running
the affected version, or say nothing. For a package that parses untrusted wire frames,
HOCON and HTTP input, that is the wrong default.

Two adjacent governance files are also absent, and they are not covered by #539:

• CODEOWNERS — never existed in the repository's history. Nothing routes review, and
  main is branch-protected requiring a PR, so the protection currently has no reviewer
  policy behind it.
• CONTRIBUTING.md — existed and was deliberately removed (a4ae7dfd chore(repo): replace CONTRIBUTING.md with issue templates, after 30f2ce90 docs: add CONTRIBUTING.md covering workflow + commit conventions). That was a considered
  decision, so this is not "restore it" — it is worth noting that AGENTS.md now carries
  the contribution standards and nothing links an outside contributor to it from the
  places GitHub surfaces (no CONTRIBUTING.md, no PR template).

Bus factor is 1 across all of it: one maintainer, no CODEOWNERS, no documented escalation
path, and admin bypass on the release merge.

Proposed shape

Ordered by how much they reduce risk per unit of effort:

1. Enable GitHub private vulnerability reporting (Settings → Code security). One
   toggle; it gives the Security tab a working "Report a vulnerability" button and makes
   the template's "contact the maintainer privately" true. This is independent of [Feature] Security scanning: CodeQL, dependency review/OSV, SECURITY.md #539
   and can land immediately.
2. SECURITY.md — tracked in [Feature] Security scanning: CodeQL, dependency review/OSV, SECURITY.md #539, not here. Once it exists, drop the
   (or, if absent, …) hedge from security_report.yml:12-13; that edit is small enough
   to ride along with whichever issue lands first.
3. CODEOWNERS — even a single-line * @pathosDev makes review routing explicit and
   gives branch protection something to enforce. It also documents the bus factor rather
   than leaving it implicit.
4. Contribution entry point — either a thin CONTRIBUTING.md that points at
   AGENTS.md for the standards, or a PR template that does. The previous removal
   replaced it with issue templates, which cover filing but not contributing.

The scope-boundary line for SECURITY.md is worth stating in whatever lands, because it
is not boilerplate for this project: the cluster transport defaults to plaintext,
unauthenticated TCP by design
(docs/src/content/docs/operations/security/cluster-security.mdx), so reports about that
default are out of scope while reports about the documented mitigations failing are very
much in scope. Several findings in the audit catalog are precisely the latter.

Acceptance

• Private vulnerability reporting is enabled on the repository.
• CODEOWNERS exists and covers the tree.
• An outside contributor reaches the working standards from a GitHub-surfaced file.
• The (or, if absent, …) hedge is removed from security_report.yml once [Feature] Security scanning: CodeQL, dependency review/OSV, SECURITY.md #539 lands SECURITY.md.

Verification status

Confirmed by reading and by API query.

File absence, directly:

$ ls SECURITY.md CONTRIBUTING.md CODEOWNERS .github/SECURITY.md .github/CONTRIBUTING.md .github/CODEOWNERS docs/SECURITY.md
ls: cannot access 'SECURITY.md': No such file or directory
ls: cannot access 'CONTRIBUTING.md': No such file or directory
ls: cannot access 'CODEOWNERS': No such file or directory
ls: cannot access '.github/SECURITY.md': No such file or directory
ls: cannot access '.github/CONTRIBUTING.md': No such file or directory
ls: cannot access '.github/CODEOWNERS': No such file or directory
ls: cannot access 'docs/SECURITY.md': No such file or directory

History, which distinguishes "never existed" from "was removed" —
git log --all -- SECURITY.md CODEOWNERS returns nothing, while the same query for
CONTRIBUTING.md returns the two commits quoted above.

Repository settings, via the GitHub API rather than inferred:

$ gh api repos/pathosDev/actor-ts/private-vulnerability-reporting
{"enabled":false}
$ gh api repos/pathosDev/actor-ts --jq '.security_and_analysis'
{"dependabot_security_updates":{"status":"enabled"},"secret_scanning":{"status":"enabled"},"secret_scanning_non_provider_patterns":{"status":"disabled"},"secret_scanning_push_protection":{"status":"disabled"},"secret_scanning_validity_checks":{"status":"disabled"}}

Related: #539 (open) owns SECURITY.md alongside CodeQL and OSV scanning — the
SECURITY.md half of the original note is a duplicate of it and is deliberately not
re-filed here. #617 raised the same thing and was closed NOT_PLANNED / duplicate
against #539; its analysis is still accurate and worth reading when #539 is picked up.
What is new in this issue is the disabled private-reporting toggle, CODEOWNERS, and the
contribution entry point.

Part of the production-readiness review batch — tracked in #913.