chore: prepare repository for open source

[calvin-archastro]

Summary

• add the MIT license, changelog, contributor guide, security policy, code of conduct, issue forms, and pull request template
• add least-privilege CI, Dependabot, and immutable Action pins; harden the release workflow
• move the Go module to github.com/ArchAstro/gh-stacked, adopt supported Go toolchains, and upgrade dependencies past all reported advisories
• improve installation and public-facing documentation, and replace private/environment-specific fixtures in the current tree

Verification

• make check
• tests and race detector on Go 1.25.12 and Go 1.26.5
• go mod verify
• Govulncheck v1.6.0: no vulnerabilities
• Actionlint v1.7.12 with ShellCheck v0.11.0
• Gitleaks v8.30.1 across all 79 commits: no leaks
• dependency license check
• release build and CLI smoke tests

Repository settings already applied

• rebase-only merges and automatic merged-branch deletion
• vulnerability alerts and automated security fixes
• public-facing description/topics and disabled unused wiki
• sanitized incident report recreated as merge-all silently reverts main changes when branch is not rebased #13; the original issue was permanently deleted so its edit history cannot expose private incident details

Publication note

Do not flip visibility until deciding whether to retain existing history. Existing commits and immutable GitHub pull-request refs contain ordinary contributor email addresses and historical test fixtures naming a private repository. No credentials or private source were detected. If those names must not become public, publish this sanitized tree as a fresh repository instead of exposing this repository's existing history.