feat: open source readiness

[quiet-node]

Summary

• Adds all open source community health files: Apache 2.0 LICENSE, CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, CHANGELOG.md
• Adds GitHub issue templates (bug report, feature request), PR template, and release workflow
• Comprehensive README overhaul: technology badges, Getting Started flow, Architecture & Security section, and What's next for Thuki roadmap
• Fixes all security claim accuracy across docs and sandbox: correct network egress posture, read-only filesystem scope, and memory cap status
• Replaces all em dashes throughout every document
• Renames product from "AI assistant" to "AI secretary" globally
• Updates author attribution to Logan Nguyen with X profile link
• Adds missing metadata (description, repository, homepage) to package.json and Cargo.toml
• Documents THUKI_SYSTEM_PROMPT in docs/configurations.md and fixes default prompt description
• Adds conventional commits guidance to CONTRIBUTING.md
• Adds target/ to .gitignore and fixes actions/checkout version comments

Test Plan

• All 350 frontend tests pass (bun run test)
• All backend tests pass (bun run test:backend)
• README renders correctly on GitHub: badges, anchor links, roadmap section
• All internal doc links and cross-references resolve
• Release workflow triggers correctly on a v*.*.* tag

🤖 Generated with Claude Code

[quiet-node]

Code review

Found 5 issues:

1. PULL_REQUEST_TEMPLATE.md tells contributors to manually update CHANGELOG.md, but RELEASING.md (introduced in the same PR) explicitly forbids this because release-please owns the file exclusively. Contributors following the template will create conflicts on every release PR.

https://github.com/quiet-node/thuki/blob/86b05507aaa253568c2d200b5c479f5f1652b2e9/.github/PULL_REQUEST_TEMPLATE.md#L15-L17

2. README.md claims docs/configurations.md explains "how to change the default model and Ollama URL", but neither setting exists anywhere in the codebase. The configurations file only documents VITE_QUOTE_* display limits and THUKI_SYSTEM_PROMPT. Model switching is a roadmap item, not a current feature.

thuki/README.md

Lines 183 to 185 in 86b0550

	See [docs/configurations.md](docs/configurations.md) for the full configuration reference, including how to change the default model and Ollama URL.

3. RELEASING.md uses em dashes (—) in the "Files Managed by release-please" section. CLAUDE.md says "Never use em dashes (—) in any output: code comments, documentation, markdown files, commit messages, or prose."

thuki/RELEASING.md

Lines 40 to 43 in 86b0550

	- `CHANGELOG.md` — written by release-please on every release PR
	- `package.json` `"version"` field — bumped automatically
	- `src-tauri/Cargo.toml` `version` field — bumped automatically

4. The release build runs bun run test and bun run test:backend, which have no coverage gate. PR CI enforces 100% coverage via bun run test:coverage and bun run test:backend:coverage. A release could ship code that passed PR checks but was later merged without re-verifying coverage at release time.

thuki/.github/workflows/release-please.yml

Lines 52 to 57 in 86b0550

	- name: Run frontend tests
	run: bun run test
	- name: Run backend tests
	run: bun run test:backend

5. SECURITY.md lists the attack surface but omits screenshot.rs, which is a registered Tauri command (capture_screenshot_command) that invokes macOS screencapture to capture user-selected screen regions. This is a relevant system-level capability that should be documented alongside the other IPC boundary entries.

thuki/SECURITY.md

Lines 14 to 21 in 86b0550

	- The Tauri IPC boundary between the frontend and Rust backend
	- The macOS Accessibility API integration that captures selected text and screen bounds at activation (`context.rs`)
	- The Docker sandbox configuration (network isolation, capability dropping)
	- The local SQLite database storing conversation history
	- Image processing via the `image` crate
	## Supported Versions

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

[quiet-node]

Code review

Found 1 issue:

1. CONTRIBUTING.md tells contributors to run bun run test:backend:coverage and bun run test:all:coverage before submitting PRs, but the Prerequisites section only states "Thuki builds against stable Rust" — it never mentions that the nightly-2026-03-30 toolchain is required. Both coverage commands hard-code cargo +nightly-2026-03-30 llvm-cov in package.json. A contributor following the guide verbatim will hit a toolchain 'nightly-2026-03-30' is not installed error when running the mandatory pre-PR checks.

thuki/CONTRIBUTING.md

Lines 27 to 35 in e44a94e

	**Rust:** required for the Tauri backend
	```bash
	curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
	```
	After installation, restart your shell or run `source ~/.cargo/env` to make `cargo` available. Thuki builds against stable Rust.

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

[quiet-node]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

Verified this round:

• All 6 issues from prior review rounds are confirmed fixed
• GitHub Actions: all runners and actions are free-tier compatible; macos-latest is required for backend tests and the release build (macOS framework linkages), and is free with unlimited minutes once the repo is public
• No paid GitHub features (Advanced Security, CodeQL, paid marketplace actions) referenced anywhere
• screenshot.rs, release-please-config.json TOML jsonpath, and all cross-references verified accurate
• CHANGELOG.md dead links are intentional bootstrap artifacts; release-please resolves them on first release

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}