chore: add CHANGELOG and GitHub issue/PR templates

- CHANGELOG.md follows Keep a Changelog; Unreleased covers infra hardening, sanity fix, README rewrite
- Bug report + feature request issue forms with Squire-specific fields (version, OS, child CLI)
- PR template enforces conventional commits and the v1.x API-freeze discipline
- Issue config disables blank issues; points security to SECURITY.md and discussion to Discussions

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: PythonLuvr

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,64 @@
+name: Bug report
+description: Something is broken or behaves unexpectedly.
+labels: ["bug"]
+body:
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: A clear, concise description of the bug.
+      placeholder: When I call `start()` with a `.cmd` binary on Windows, ...
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What did you expect to happen?
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Minimal reproduction
+      description: Smallest Squire snippet that reproduces the bug. Include the binary you are spawning and any relevant options.
+      render: ts
+    validations:
+      required: true
+  - type: input
+    id: squire-version
+    attributes:
+      label: Squire version
+      description: Output of `npm ls @pythonluvr/squire`
+      placeholder: 1.0.0
+    validations:
+      required: true
+  - type: input
+    id: node-version
+    attributes:
+      label: Node version
+      placeholder: v22.11.0
+    validations:
+      required: true
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating system
+      options:
+        - Linux
+        - macOS
+        - Windows
+        - Other (describe below)
+    validations:
+      required: true
+  - type: input
+    id: cli-name
+    attributes:
+      label: Child CLI (if relevant)
+      description: Which binary Squire was spawning. Include version if a specific CLI version matters.
+      placeholder: claude 0.4.2 / codex 0.7.0 / gemini 0.1.5 / custom
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs / error output
+      description: Any stderr, error events, or stack traces. Strip secrets first.
+      render: shell

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/PythonLuvr/squire/security/policy
+    about: Report security issues privately. Do not open a public issue.
+  - name: Question or discussion
+    url: https://github.com/PythonLuvr/squire/discussions
+    about: For general questions, ideas, or open-ended discussion, please use Discussions.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,32 @@
+name: Feature request
+description: Suggest an addition or change to Squire.
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before filing, please remember the v1.x line is API-frozen. Additive changes are fine; renames, removals, or changes to existing event-union shapes wait for v2.0.
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem are you trying to solve?
+      description: Describe the use case, not the proposed solution. "I am building X, and Squire makes step Y harder than it needs to be."
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: How you would like Squire to change. API sketch welcome.
+      render: ts
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Workarounds you tried, custom adapters you wrote, other libraries you evaluated.
+  - type: checkboxes
+    id: additive
+    attributes:
+      label: Is this additive?
+      options:
+        - label: My proposal is additive (new types, new event variants, new options). It does not break the existing v1.x API.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,23 @@
+<!-- Thanks for contributing to Squire. Please complete the sections below. -->
+
+## What does this PR do?
+
+<!-- One paragraph describing the change and why. Link any related issue. -->
+
+## Type of change
+
+- [ ] Bug fix (non-breaking)
+- [ ] New feature, additive (non-breaking)
+- [ ] Documentation only
+- [ ] CI / tooling / chore
+- [ ] Breaking change (would require v2.0; please discuss in an issue first)
+
+## Checklist
+
+- [ ] `npm run check` passes locally.
+- [ ] `npm run check:strict` passes locally (coverage gate >= 85%).
+- [ ] No em dashes in any committed file.
+- [ ] No personal data, paths, or non-allowlisted IPs in any committed file.
+- [ ] If adding a new feature: tests are included.
+- [ ] If adding a new event variant or option: docs in `docs/api.md` and README are updated.
+- [ ] Conventional commit subject (`feat:`, `fix:`, `docs:`, `chore:`, `test:`, `ci:`).

CHANGELOG.md

@@ -0,0 +1,42 @@
+# Changelog
+
+All notable changes to Squire will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+The v1.0 public API surface (everything exported from `src/index.ts`) is frozen. Additive changes ship on the v1.x line as minor bumps. Breaking changes wait for v2.0.
+
+## [Unreleased]
+
+### Added
+- `SECURITY.md` with private vulnerability reporting path.
+- CI matrix across Ubuntu, macOS, and Windows on Node 20 and 22, plus a dedicated coverage job.
+- `scripts/check-no-openwar-imports.mjs` enforcing zero coupling between Squire's `src/` and OpenWar.
+- `ej_identifier` blocklist in `scripts/check-sanity.mjs` catching internal-project leakage beyond the generic personal-data patterns.
+- Expanded `.gitignore` covering `.env*`, cookie files, local fixture overrides, and editor/OS artifacts.
+
+### Fixed
+- `scripts/check-sanity.mjs` `SELF` resolution now uses `fileURLToPath` for cross-platform correctness. The previous URL-pathname hack worked on Windows by accident but failed on Linux and macOS.
+
+### Changed
+- README rewritten with natural-voice intro covering the spawn-pain problem, Squire's role, the tool-not-framework positioning, and the subscription-auth angle.
+- README logo switched to the transparent variant for theme compatibility.
+
+## [1.0.0] - 2026-05-18
+
+### Added
+- Initial public release.
+- `Squire` class managing one child-process lifecycle: `start()`, `send()`, `stop()`, plus `pid`.
+- Cross-platform `child_process.spawn` wrapper with Windows `.cmd` / `.bat` / extensionless-binary handling. POSIX never uses a shell; Windows auto-detects via `needsShell()`.
+- `SquireEvent` discriminated union: `stdout`, `stderr`, `text_delta`, `message_start`, `message_stop`, `error`.
+- Built-in `text-stream` adapter. `text_delta` duplicates `stdout` in v1.0; per-CLI parsers are reserved for v1.1.
+- `SquireAdapter` public interface for consumers to register custom parsers via `registerSquireAdapter`.
+- MCP forwarding: pass inline `mcp.servers` (Squire writes a temp config) or `mcp.configPath` (Squire passes it through). `--mcp-config` flag defaults to the standard, overridable via `mcp.configFlag`.
+- Claude Code permission auto-setup: `autoSetup.claudeCode` merges `allowList` patterns into `~/.claude/settings.json` atomically.
+- `SquireError` with discriminated `code` field and `SquireAutoSetupError` carrying the offending settings path.
+- Full TypeScript types for every public surface.
+- 52 tests, 96.3% line coverage on `src/`.
+- Documentation: `README.md`, `docs/api.md`, `docs/openwar-integration.md`, `docs/contributing.md`.
+
+[Unreleased]: https://github.com/PythonLuvr/squire/compare/v1.0.0...HEAD
+[1.0.0]: https://github.com/PythonLuvr/squire/releases/tag/v1.0.0