docs: complete GitHub's community standards (contributing, code of conduct, templates) #97

GitHub's community profile of nodkey is at 62 % (https://github.com/code6x/nodkey/community, seen 2026-10-18). It has a README, a LICENSE (Apache-2.0), a description, and SECURITY.md, and private vulnerability reporting is on. It is missing a code of conduct, a contributing guide, issue templates and a pull request template.

The Open Source Guides say what each file is for. All these pages were seen on 2026-10-18:

• Starting an Open Source Project: a README, a contributing guide and a code of conduct, next to the license;
• Your Code of Conduct: adopt one early, say who enforces it and how to report;
• Building Welcoming Communities: issue and pull request templates, and clear steps for new contributors;
• Best Practices for Maintainers: write your processes down.

GitHub's checklist is in About community profiles for public repositories. Its templates are in Configuring issue templates for your repository.

Most rules exist already in AGENTS.md, docs/releasing.md and SECURITY.md. The new files should point to them, not copy them.

Done when

• CONTRIBUTING.md says how to:
  • report a bug or ask for a feature: an issue with a "Done when" list;
  • report a security problem: privately, as SECURITY.md says;
  • build and test: Go 1.26 or newer, the commands of AGENTS.md, and the end-to-end test with Docker;
  • make a pull request: one issue gives one pull request, with a Conventional Commits title and a squash merge. Tests cover the deny paths too. The docs, DESIGN.md and THREAT-MODEL.md change in the same pull request. It also covers the rule for dependencies, no private names or addresses, and plain English;
  • license a contribution: under Apache-2.0 (section 5 of the license), with no CLA.
    It links to AGENTS.md, DESIGN.md and THREAT-MODEL.md.
• CODE_OF_CONDUCT.md is the Contributor Covenant 2.1, with a way to report. The owner decides the contact.
• .github/ISSUE_TEMPLATE/ has two forms and a config.yml:
  • Bug report: the nodkey version, the OS, broker or client, what happened and what you expected, and the log lines. It warns to remove tokens, keys, host names and addresses first.
  • Feature request: the problem, the idea, and a "Done when" list.
  • config.yml: a link to the private security report. Turn blank issues off or leave them on, and say which in the pull request.
• .github/pull_request_template.md has the issue it closes and a short checklist: the title, tests with deny paths, the docs updated, the security review done, and no private data.
• AGENTS.md lists the new files in its layout.
• The community profile page shows every file as done. The owner decides whether to turn on Accept content reports (a repository setting). The pull request says whether SUPPORT.md and GOVERNANCE.md are needed now. For a project with one maintainer, they are probably not.