chore: add OSS readiness files and contributor docs

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,64 @@
+name: Bug Report
+description: Report a bug in ProjectX
+title: "[Bug] "
+labels: ["bug"]
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: What went wrong?
+      description: A clear description of the bug.
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Go to ...
+        2. Click on ...
+        3. See error
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected vs actual behavior
+      description: What did you expect to happen, and what actually happened?
+    validations:
+      required: true
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Your setup
+      placeholder: |
+        - ProjectX version/image tag: latest
+        - Deployment: Docker / manual
+        - OS: Ubuntu 22.04
+        - Browser: Firefox 124
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant logs (optional)
+      description: Run `docker logs <container-name>` and paste anything relevant here.
+      render: shell
+
+  - type: textarea
+    id: screenshots
+    attributes:
+      label: Screenshots (optional)
+      description: Drag and drop screenshots here if applicable.
+
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Before submitting
+      options:
+        - label: I've searched existing issues and this hasn't been reported yet.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: false

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,45 @@
+name: Feature Request
+description: Suggest a new feature or improvement for ProjectX
+title: "[Feature] "
+labels: ["feature"]
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: What's your idea?
+      description: A clear description of the feature you'd like to see.
+    validations:
+      required: true
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem does it solve?
+      description: Help us understand the motivation behind this request.
+    validations:
+      required: true
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Anything else? (optional)
+      description: Mockups, examples from other apps, implementation ideas, alternatives you've considered.
+
+  - type: dropdown
+    id: contribution
+    attributes:
+      label: Want to help?
+      options:
+        - "Yes, I'd like to implement this"
+        - "I can help test and give feedback"
+        - "Just sharing the idea"
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Before submitting
+      options:
+        - label: I've searched existing issues and this hasn't been requested yet.
+          required: true

.github/SECURITY.md

@@ -0,0 +1,7 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Use GitHub's [private vulnerability reporting](../../security/advisories/new) to report security issues confidentially. Do not open public issues for security vulnerabilities.
+
+I aim to acknowledge reports within a few days and publish a fix as quickly as the severity warrants.

.github/pull_request_template.md

@@ -0,0 +1,41 @@
+## Before you submit
+
+> **New feature?** Please open an issue first and get approval from the maintainers before writing any code.
+> PRs that introduce features without a prior discussion will be closed.
+>
+> **Used AI assistance?** That's fine - but make sure you've read and understood every line of the diff
+> before submitting. PRs that show no sign of self-review will be closed without detailed feedback.
+>
+> **Keep it focused.** One thing per PR. Don't bundle a bug fix with a refactor or unrelated cleanup.
+> If it's not ready, open it as a draft instead.
+
+---
+
+## What does this PR do?
+
+<!-- A short summary of the change and why it's needed. Link the issue it addresses if applicable. -->
+
+Closes #
+
+## How did you test this?
+
+<!-- Tell us what you actually did to verify this works. What did you run? What did you click through?
+     A quick note like "spun up Docker, added a book, confirmed it shows in the library" is perfect.
+     This helps us review with confidence and speeds up the merge. -->
+
+## Screenshots
+
+<!-- If this touches the UI, please include a before/after screenshot or a short screen recording.
+     You can drag and drop images directly here. -->
+
+## Anything non-obvious in the diff?
+
+<!-- Did you make any tricky decisions or trade-offs? Anything you'd want a reviewer to pay
+     extra attention to? This is your chance to guide the review. -->
+
+## Checklist
+
+- [ ] I've read through my own diff
+- [ ] This PR was discussed in an issue and has maintainer approval (for new features)
+- [ ] Lint and tests pass locally
+- [ ] No unintended files included (build artifacts, `.env`, personal configs)