Polish public repository hygiene

[AmeerJ97]

Summary

• Add contributor and security policy docs for the public repo.
• Add a public repository audit documenting branch state, GitHub settings, installer separation, and remaining follow-ups.
• Tighten issue/PR templates and add package repository metadata.
• Separate this fork from the official x.ai Grok CLI: script installs now use grok-vertex under ~/.grok-vertex/bin, while grok remains available for the official x.ai installer.
• Update GitHub repository metadata: homepage, topics, wiki disabled, vulnerability alerts enabled, and private vulnerability reporting enabled.

Root cause / rationale

The repository is public and starting to receive automated dependency activity, but some public maintenance surfaces were incomplete or settings-only: no live security policy yet, no repo topics/homepage, wiki was enabled despite docs living in-repo, blank issues were allowed, and local stale branches needed an explicit audit record instead of replaying old work wholesale.

There is also a real command collision with the official x.ai CLI. The official installer at https://x.ai/cli/install.sh owns ~/.grok/bin/grok, ~/.grok/bin/agent, ~/.grok/config.toml, and shell PATH setup. This fork previously used the same grok command and ~/.grok/bin script install target, so the two installers could overwrite or shadow each other. New fork installs now use grok-vertex and ~/.grok-vertex for script-managed binaries/metadata.

Verification

• git diff --check
• bun run format
• bun run lint (passes with existing warnings in untouched source files)
• bun run typecheck
• bun run test
• bun run build
• bun run build:binary
• bunx --bun vitest run src/utils/install-manager.test.ts
• Local installer smoke with temp HOME: bash install.sh --binary dist/grok-standalone --no-modify-path
• Local command check: grok resolves to official x.ai CLI; grok-vertex resolves to this fork and reports 1.1.6
• Remote branch protection, PR state, repository metadata, vulnerability alerts, and open Dependabot alerts checked with gh

Risk and rollout

Low runtime risk. The code change is limited to script install/update/uninstall metadata and package bin aliases. Existing legacy script-managed installs under ~/.grok remain readable for update/uninstall compatibility, but new installs use ~/.grok-vertex to avoid clobbering the official x.ai CLI.

Docs / config impact

• README, contributing, security, and maintainer docs updated
• GitHub workflow/config changes called out explicitly
• Install script and package bin metadata updated to expose grok-vertex

Fixes #

Checklist

• Scope is focused and unrelated changes are excluded
• CI-relevant checks were run locally and are expected to run in GitHub Actions