Harden repository governance

[scottdensmore]

Summary

• pin every GitHub Action to the verified commit behind its documented major version
• add bug and feature issue forms plus a pull request template
• add repository-wide security and conduct policies
• link the new community guidance from the README and contributor guide

Why

The interpreter and documentation are already well covered, but repository governance was not technically enforced and GitHub reported an incomplete community profile. These changes make workflow dependencies immutable, provide clear contribution paths, and document the project's security boundary and private reporting process.

Impact

There is no interpreter or CLI behavior change. Dependabot can continue updating GitHub Actions while their workflow references remain immutable.

Validation

• git diff --check
• parsed every .github/**/*.yml file with Ruby's YAML parser
• verified each action SHA against the corresponding GitHub tag
• confirmed every workflow uses: reference is a full commit SHA
• resolved SECURITY.md as the single repository-wide policy
• make check (82.9% coverage, zero lint findings)
• make vuln (no vulnerabilities found)