docs(community): add CODE_OF_CONDUCT, issue templates, and PR template

[Davincc77]

Summary

Improves the repository's GitHub Community Standards profile by adding the three items currently flagged as missing on the community-standards page:

• A Code of Conduct (Contributor Covenant v2.1)
• Issue templates (bug, feature request, spec RFC, plus a config.yml that links to the security policy and Discussions)
• A Pull request template with scope / impact / governance checklists

No spec, schema, SDK, vector, registry, package, CI, or release changes.

Files added

File	Purpose
CODE_OF_CONDUCT.md	Contributor Covenant v2.1, adapted to route security reports to SECURITY.md and conduct reports through GitHub's report-content flow. No private email is exposed beyond what SECURITY.md already publishes.
.github/ISSUE_TEMPLATE/config.yml	Disables blank issues; surfaces the security policy, Discussions, and SPEC.md as contact links.
.github/ISSUE_TEMPLATE/bug_report.yml	Structured bug form with component / version / repro / secret-redaction confirmations.
.github/ISSUE_TEMPLATE/feature_request.yml	Non-normative enhancements only; explicitly defers wire-format / schema / vector changes to the RFC template.
.github/ISSUE_TEMPLATE/spec_rfc.yml	Normative spec changes with motivation, compatibility impact, security considerations, migration story, and alternatives.
.github/pull_request_template.md	Checklist covering scope, schema/SDK/vector impact, tests, security / secret scan, and governance reminders (no publish, no version bump, no locked-file edits out of scope).

Design notes

• Contact policy. SECURITY.md already publishes a project security email; the Code of Conduct does not duplicate or expose a separate private email. Conduct reports are routed through GitHub's built-in report-content flow plus the channels listed in the README, and security reports continue to flow through SECURITY.md.
• No overclaiming. Templates reference v3.0 and v4 (preview / GA-candidate) consistent with the current repository state; no language asserts v4 GA has shipped.
• Governance alignment. The PR template encodes the project's no-publish / no-tag / no-version-bump rules and the schema/SDK/vector scope guard, so contributors see them on every PR.
• Templates use GitHub's YAML schema (name/description/body) and validate as YAML locally.

Scope confirmation

• Docs / community only
• No changes to SPEC*.md, schema/, vectors/, SDKs, migrator, registry, or workflows
• No package version bumps; no release, tag, npm, PyPI, or Zenodo artefacts
• Does not interfere with the P0-6 vectors work (rebased onto current main, which already includes vectors(v4): P0-6 — v4 GA strict cross-impl test vectors (Python + TypeScript) #46)

Testing

• All four issue-template YAML files parse with yaml.safe_load
• git diff origin/main...HEAD is limited to the six new files listed above
• No existing files modified

🤖 Generated with Claude Code