docs: add contributor, security, and changelog docs

[patramsey]

Docs and config only. No production code changes.

The repo was public with a README and a LICENSE and nothing else — no statement of how to contribute, no conduct policy, no private channel for reporting a vulnerability, no release history outside the auto-generated tag notes. GitHub's community-standards checklist flagged all four.

These are tailored rather than boilerplate, because the generic version is wrong in the places that matter for a tool holding registrar credentials.

CONTRIBUTING.md

Documents the two invariants that are easy to break by accident:

• POST is only retried when X-Idempotency-Key is set. Relaxing that can double-register a domain.
• dns update / domain update are read-modify-write, because the API does full PUT replacement. A partial body silently drops fields.

Plus the things that aren't guessable from the tree: why -count=1 is required (internal/api/gen shells out to scripts/spec_to_30.py and reads namecom.api.yaml; Go's test cache tracks neither, so a cached pass hides a broken preprocessor), that zz_generated.go and namecom.api.yaml are not hand-edited, and that re-vendoring the spec means updating SPEC_SHA in the same commit.

SECURITY.md

Scopes the categories that actually apply here rather than generic ones: token leakage via --debug/--debug-file or config file modes, the token_cmd shell exec, a command whose real request diverges from its --dry-run preview, and sandbox/production confusion. Says not to paste a live token into a report.

Private vulnerability reporting has been enabled on the repo, so the link in this file resolves.

Issue / PR templates

The bug template asks for --dry-run output on mutating commands — the single most useful artifact for diagnosing one — and warns that --debug output carries request/response bodies even though the token is redacted. The PR template has a matching checklist item for TestDryRunMatchesRealRequest_*.

CHANGELOG.md

Starts at 0.2.0. Reconstructing entries for the fourteen earlier tags would have meant inventing detail the commit history doesn't support (Feat/fix bugs (#9)), so it points at the releases page for those instead.

.gitignore

Grows .superpowers/ and docs/plans/ alongside the existing .claude/ entry. Agent working artifacts are a record of how the work was produced, not something a contributor needs, and they land in the tree next to real source — which makes them easy to stage by accident.

Note on CLAUDE.md

It stays gitignored here, so CONTRIBUTING.md inlines the architecture context a contributor needs instead of linking to a file that doesn't exist on GitHub.

Test plan

• go build ./... && go vet ./... clean
• Every relative link in the new files and the README resolves to a tracked (or newly added) path — verified by script, 15/15
• No production code touched, so no behavior to test