chore: add issue templates and CodeQL scanning

Bug report and feature request forms enforce the no-real-client-data
rule up front; config links route vulnerabilities to SECURITY.md and
extension questions to docs.check.tech. CodeQL analyzes
javascript-typescript on push, PR, and a weekly schedule.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: DailenG

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,53 @@
+name: Bug report
+description: Something in CheckDeployManager misbehaves
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the report. One rule before you start: **no real client data**.
+        No real tenant names, tenant GUIDs, rule URLs from your deployment, or
+        captured webhook payloads. Substitute the fictional sample tenant
+        (Harborview Physical Therapy) or redact.
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened
+      description: What did you do, what did you expect, and what happened instead?
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Create a tenant
+        2. Publish with an empty delta
+        3. Open the Artifacts tab
+    validations:
+      required: true
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Surface
+      options:
+        - Management UI
+        - Operator API
+        - Public rules delivery
+        - Upstream sync or cron
+        - Artifacts or policy generation
+        - Deploy to Cloudflare or provisioning
+        - Other
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version or commit
+      placeholder: v0.1.0
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant logs
+      description: Wrangler or browser console output. Redact anything identifying.
+      render: text

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/DailenG/CheckDeployManager/blob/main/SECURITY.md
+    about: Please do not open public issues for vulnerabilities. Follow the security policy instead.
+  - name: Check extension questions
+    url: https://docs.check.tech
+    about: Questions about the Check browser extension itself belong with CyberDrain, not this deployment manager.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,29 @@
+name: Feature request
+description: Propose an improvement or new capability
+labels: [enhancement]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Check BACKLOG.md first: the item may already be scoped. The project
+        deliberately stays small (no frontend frameworks, no KV, no new
+        runtime dependencies without discussion), so proposals that fit that
+        shape land faster.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What are you trying to do that the project makes hard today?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: How should it work? Sketch the operator experience, not just the code.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered

.github/workflows/codeql.yml

@@ -0,0 +1,26 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "26 14 * * 2"
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@v7
+      - uses: github/codeql-action/init@v4
+        with:
+          languages: javascript-typescript
+      - uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:javascript-typescript"

BACKLOG.md

@@ -3,6 +3,17 @@
 Planned work that is scoped but not yet started. Items graduate from here into
 commits; keep entries current when scope changes, and delete them when shipped.
 
+## Status board (2026-07-03)
+
+Current work queue, in order. Update as items land.
+
+- [x] v0.1.0 release tag and notes (shipped: releases/tag/v0.1.0)
+- [x] Issue templates (bug report, feature request, security pointer)
+- [x] CodeQL scanning workflow
+- [ ] Onboarding wizard (item 1 below). Phase status is tracked inside the
+      item: backend endpoint with tests, then wizard page, then redirect,
+      then docs, then wiki regeneration.
+
 ## 1. Onboarding wizard on first login
 
 **Goal:** guide a fresh deployment through runbook steps 5 through 8 (instance