fix: Address audit findings — security, CI/CD, OSS readiness

[aadil96]

Summary

Addresses all findings from a comprehensive open-source maintainer audit.

Changes

🔴 Critical

• API key masking: setup.sh now uses read -rs to suppress terminal echo when entering API keys
• Lockfile: Added yarn.lock for deterministic, supply-chain-safe dependency resolution

🟠 Major

• Coder bash scoping: Deny-list for rm -rf, sudo, git push --force, pipe-to-shell patterns
• Profile skill dedup: Removed 5 duplicated skill dirs from profiles/ws/skills/
• CI/CD pipeline: GitHub Actions with lint, shellcheck, frontmatter validation, sensitive data scan, README sync check
• Secret sanitization: Redacts API keys, tokens, and credentials from debug logs and persisted delegation output

🟡 Minor

• CODE_OF_CONDUCT.md: Contributor Covenant v2.1
• SECURITY.md: Vulnerability reporting policy and best practices
• Issue templates: Bug report and feature request templates
• README sync: Skill table now matches filesystem (21 skills)
• ShellCheck directive: Added to setup.sh

Checklist

• No sensitive data (API keys, tokens, secrets, passwords)
• No personal paths
• No machine-specific config
• Documentation updated
• CHANGELOG.md updated