chore(oss): polish for OSS distribution (FUNDING + CONTRIBUTING + README)

[Cramraika]

Summary

P2a of the framework-wiring/OSS-sponsorship plan. Polishes this repo for ongoing OSS positioning now that the engine has also been absorbed upstream into vagary-platform/backend/framework/notifications/fanout/.

• `.github/FUNDING.yml`: add verified Buy Me a Coffee handle (`vagarylife` → https://buymeacoffee.com/vagarylife). GH Sponsors line unchanged. Polar/Ko-fi remain commented out (no accounts yet).
• `CONTRIBUTING.md` (new): dev setup, PR workflow, code style, security disclosure pointer, MIT note, and an explicit upstream-relationship section.
• `README.md`: rename-aware title + badges (now `Cramraika/bulk`), BMC badge, expanded sponsor section, new "Upstream / where this engine lives" section, Quick Start with real clone URL + new container name, MIT footer, Contributing defers to CONTRIBUTING.md + SECURITY.md, rename heads-up note.

History secret-scan ✅

Scanned all branches for committed secrets:

• `.env` was added in commits `74b95f8`, `53077ab`, `eedad94` (Aug 2025). Inspected all three — every entry was either an empty string or a placeholder (`your_email@gmail.com`, `your_app_password`, `admin@example.com`, etc.). No real secrets leaked. `.env` is not in current HEAD; `.env.example` serves as the template.
• Current-tree grep on common secret patterns returned only env-var lookups, redaction logic, placeholder strings, and code-comment strings.

⚠️ DO NOT MERGE

This PR is part of P2 of the larger plan and is gated by the manual public-flip gate (P2c) on the upstream plan. Hold for explicit user confirmation before merging.

Test plan

• FUNDING.yml renders correctly on GitHub (sponsor button + BMC link)
• CONTRIBUTING.md renders cleanly
• README.md renders cleanly with all badges resolving
• No real secrets in history
• Manual review of upstream-pointer wording (does it accurately describe the bulk ↔ fanout relationship?)

🤖 Generated with Claude Code

Summary by CodeRabbit

• Documentation

  • Added comprehensive contribution guidelines with development setup instructions, pull request workflow expectations, and code style standards.
  • Updated project documentation with new repository branding, expanded sponsorship options, and security reporting procedures.

• Chores

  • Updated funding configuration.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR updates project documentation and configuration to reflect a repository rebrand from bulk_api_trigger to bulk, adds a new contribution guidelines document, and updates funding configuration with an active sponsor link.

Changes

Cohort / File(s)	Summary
Funding Configuration .github/FUNDING.yml	Activated buy_me_a_coffee: vagarylife entry, replacing the previously commented placeholder and removing stale commented lines.
Documentation CONTRIBUTING.md, README.md	Added comprehensive contribution guidelines document and updated README with repository rebrand, expanded sponsor options, upstream monorepo relationship, revised setup/deployment instructions, and explicit licensing section.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~15 minutes

Possibly related PRs

• docs(rename): cross-reference fleet rename #12: Both PRs update project documentation and configuration to reflect the repository rename from bulk_api_trigger to bulk, ensuring consistency across branding and infrastructure references.

Poem

🐰 From API Trigger to Bulk, the rebrand is clear,
With coffee support and guidelines so dear,
Contributing paths now beautifully bright,
Upstream monorepos, all working just right! ☕

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main changes: OSS polish with specific files (FUNDING, CONTRIBUTING, README) being updated.
Description check	✅ Passed	The description exceeds the template requirements, providing comprehensive details on changes, upstream context, security scanning, and test status.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch oss-prep-2026-04-19

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@README.md`:
- Around line 293-300: The Kubernetes manifest in the README renames resources
to "bulk" but leaves secretRef.name as "bulk-api-secrets", causing a naming
mismatch; update the secret reference to match the new naming convention (e.g.,
change secretRef.name from "bulk-api-secrets" to "bulk" or another consistent
name) and ensure any other mentions (the second occurrence around line 309) are
updated as well so the Deployment/container name "bulk" and the secret reference
are aligned.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 2e2a3d12-b411-4ec2-8a85-2d9e8a616f0b

📥 Commits

Reviewing files that changed from the base of the PR and between aa2ded9 and e7a4c04.

📒 Files selected for processing (3)

• .github/FUNDING.yml
• CONTRIBUTING.md
• README.md

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Potential stale secret name after rebrand.

Kubernetes example renames resources to bulk, but secretRef.name is still bulk-api-secrets. Consider aligning it to the new naming convention to avoid setup confusion.

Also applies to: 309-309

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@README.md` around lines 293 - 300, The Kubernetes manifest in the README
renames resources to "bulk" but leaves secretRef.name as "bulk-api-secrets",
causing a naming mismatch; update the secret reference to match the new naming
convention (e.g., change secretRef.name from "bulk-api-secrets" to "bulk" or
another consistent name) and ensure any other mentions (the second occurrence
around line 309) are updated as well so the Deployment/container name "bulk" and
the secret reference are aligned.