Governance, generated

Real files, not advice: CONTRIBUTING.md, a PR template, CODEOWNERS, SECURITY.md, commitlint, a release policy.

Scaled to how risky and public the project actually is — a small internal tool doesn't get the same governance as a public-facing API.