Establish source-available community governance

[aoiminamoto]

Summary

• establish KinaBot as an accurately described source-available community project;
• add Code of Conduct, expanded security policy, Issue Forms, PR template, CODEOWNERS, roadmap, release governance, and contributor recognition;
• document community versus commercial boundaries, commercial-license requests, trademarks, provenance, and prospective contributor terms;
• correct one historical Aoi/Toyota email display through .mailmap without rewriting Git history;
• block future @toyota.com commit metadata and limit aoi_kinabot_app/ authorship/commits to approved Aoi personal or AImoji identities;
• add release-note categories and create a genuinely scoped good first issue (Document safe synthetic test data for contributors #44).

Licensing decision

This PR deliberately does not adopt Apache-2.0. KinaBot remains under its non-commercial source-available license because the maintainer requires commercial use to obtain written permission. README and licensing materials no longer describe that model as OSI open source.

The CLA, custom license, commercial-rights chain, trademark position, and acceptance mechanism are explicitly marked for qualified legal review. This PR does not claim that review has occurred.

Authorship boundary

aoi_kinabot_app/ remains independently authored and committed only by Aoi using an approved personal or AImoji identity. External contributors may provide issues, evidence, research, review, and patch proposals and must receive accurate credit, but Aoi independently submits accepted product changes.

The historical commit 751ecd3 used aoi.minamoto@toyota.com in Git metadata. The maintainer identifies this as an unintended identity selection, not a Toyota contribution or endorsement. Original Git evidence is preserved.

Verification

• git diff --check
• Python syntax compilation for both contributor-policy scripts
• positive contributor-email and Aoi-app ownership checks on this PR range
• negative checks confirm commit 751ecd3 is rejected by both policies
• .mailmap canonical identity verified with git check-mailmap
• GitHub labels created for triage, privacy, safety, security, scoring, data integrity, community, and changelog control
• good first issue Document safe synthetic test data for contributors #44 revised to remain outside the protected application directory

Impact

• No scoring, runtime, database, authentication, privacy processing, or AWS configuration changed.
• Documentation and GitHub governance only.
• Existing immutable Git history is not rewritten.