docs(governance): add DPGA policy evidence

[FenjuFu]

Summary

• add a public privacy and data governance policy for hosted and self-hosted SkillHub instances
• add a content safety policy covering package risk, scanning, review, reporting, enforcement, appeals, and child safety
• replace the Code of Conduct's non-actionable private-channel wording with the iFLYTEK open-source contact and incident process
• expose the governance and safety policies from the root README

Why

This change prepares public, reviewable evidence for a SkillHub Digital Public Good application. In particular, it addresses the privacy and do-no-harm questions in the DPG Standard while keeping the boundary between the upstream open-source project and independently operated instances explicit.

DPGA references:

• Submission Guide
• Official application questions
• Review Policy

This follows the same policy-evidence approach used for Astron Agent in #1613 and #1616, adapted to SkillHub's actual package, scanner, review, reporting, RBAC, and audit capabilities.

Important boundaries

• this PR does not claim that every SkillHub deployment automatically complies with any law
• instance operators remain responsible for applicable-law analysis, notices, retention, data-subject requests, moderation operations, response targets, and external providers
• security scanning is configurable and cannot certify that a package is safe or lawful
• the project does not yet have enough comparable safety reports to publish a meaningful historical average response or action time
• this is a documentation and governance change; it does not modify runtime behavior or API contracts

Validation

• Backend tests passed
  • full JDK 21 run: 739 tests, 737 passed, 1 skipped, and 2 existing locale-sensitive assertions expected English but received Chinese on this Windows host
  • the affected ApiAccessDeniedHandlerTest class passed 3/3 when the test JVM was explicitly run with the English locale
• Frontend typecheck/build passed
• OpenAPI SDK unchanged because no API contract changed
• Smoke test run when relevant — not run locally because Docker and Bash are unavailable on this Windows host; GitHub CI will cover repository workflows

Commands run:

npx --yes markdownlint-cli2 CODE_OF_CONDUCT.md docs/PRIVACY_AND_DATA_GOVERNANCE.md docs/CONTENT_SAFETY.md
pnpm run typecheck
pnpm run lint
pnpm run build
./mvnw -pl skillhub-app -am test
./mvnw -pl skillhub-app -am -Dtest=ApiAccessDeniedHandlerTest -Dsurefire.failIfNoSpecifiedTests=false test

git diff --check

Additional checks:

• all repository-relative links added by this PR resolve locally
• commit is based directly on the latest origin/main
• commit has a matching DCO sign-off using the contributor's GitHub noreply address

Risk

• User-facing impact: makes governance expectations and private reporting routes easier to find
• Deployment or migration impact: none
• Rollback approach: revert the documentation commit

Notes

• Related issue: none
• Follow-up work: dedicated project security policy, production default-credential hardening, third-party/SBOM evidence, data portability documentation, applicable-law approval, and a verified SDG use case remain separate DPGA-readiness tasks
• These policies are public evidence for review, not a claim that SkillHub already satisfies every DPG indicator