chore: establish repository governance

[P4suta]

Summary

• add contribution, support, security, governance, conduct, changelog, CODEOWNERS, issue forms, and a pull request template
• group Dependabot updates, add cooldowns, and keep major upgrades deliberate
• enable CI concurrency, timeouts, non-persistent checkout credentials, and immutable Action SHA pins
• skip the fixed-runner benchmark until its repository variable is explicitly enabled
• fix the latest stable Clippy lint and install the OCaml test dependency in CI

Repository safety

• Zizmor pedantic audit: no findings
• Gitleaks and TruffleHog: no leaks
• all commits are SSH signed
• release workflow remains tag-only; no release or package publication was performed

Verification

• cargo fmt --check
• cargo clippy --workspace --all-targets --locked -- -D warnings
• cargo test --workspace --all-targets --locked (83 passed)
• OCaml tests and opam lint
• Rust/OCaml differential suite (94 fixtures)
• actionlint, schema checks, package file-list checks, and embedded-spec checks