[MarcusDavidG]

Closes #217
Closes #218
Closes #219
Closes #220

Summary

• feat(integration): example vault scenario #217 — examples/vault gains a deposit_checked owner-authorized entry point plus Deposited / Withdrawn contract events. New integration tests in examples/vault/tests/lifecycle.rs assert balances, emitted events, and the owner-only auth gate across a full deposit → withdrawal lifecycle, including an unauthorized-caller and an overdraft case.
• fix(integration): security policy contact #218 — SECURITY.md now names GitHub private vulnerability reporting as the monitored reporting route, documents a fallback when the private form is unavailable, and states acknowledgement/remediation/disclosure expectations.
• feat(integration): release notes template #219 — adds .github/release_notes_template.md, a ## Release notes section in the PR template, and a CONTRIBUTING section defining exactly which user-visible changes require an entry.
• feat(integration): issue labels taxonomy #220 — BUILD_SPEC label names now match GitHub exactly (good first issue / help wanted, space-separated), the provisioning docs explain how to sync and verify, and label-sync.yml now provisions the severity/* labels the issue forms and triage workflow already apply. repo_config.rs enforces the label list and spellings.

Notes

• The deliberately buggy deposit (open) and withdraw (missing auth) entry points are preserved: the existing AuthMatrix tests depend on that behavior. The authorized path lives in the _checked entry points.
• Per the task instructions, no builds, tests, or package installations were run locally; changes are limited to the example fixture, its tests, docs, and workflow configuration.

[drips-wave]

@MarcusDavidG Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits