Prepare public source visibility governance

[jinon86]

Summary

• switch package/license metadata to MIT and add root LICENSE
• add SUPPORT/CONTRIBUTING docs
• update SECURITY reporting path for public-safe maintainer contact
• document source-only public visibility boundary
• add gitleaks allowlist for redaction-unit-test fixture strings

Safety boundary

• Source-only public-readiness preparation.
• No repository visibility change was performed.
• No release/tag/package publish, deploy/restart/reload, DB mutation, provider/Telegram send, credential movement, history rewrite, or destructive cleanup.
• Future PRIVATE -> PUBLIC visibility remains a separate operator approval gate.

Validation

• npm run ci — passed
• npm run doctor:field-deploy — ok with existing example warnings
• npm test — 107 passed
• gitleaks detect --source . --redact --no-banner --exit-code 99 — no leaks found with committed test-fixture allowlist
• git diff --check — passed

[seoseo-ai]

Reviewed public-readiness governance PR: checks are green; source-only boundary preserved; no visibility/release/deploy action included.