chore: prep repo for going public

[StuBehan]

Summary

Adds the standard community files and a CI workflow ahead of open-sourcing the repo. Patterns adapted from stackvox's recent OSS prep.

Changes

Community files

• CONTRIBUTING.md — local setup, make targets, source layout, the rebuild-invalidates-TCC gotcha, commit/branch conventions, PR checklist
• CODE_OF_CONDUCT.md — Contributor Covenant 2.1, support@stackone.com for enforcement
• SECURITY.md — security@stackone.com, in/out-of-scope split (stackvox + deps redirect upstream), pre-1.0 latest-only support policy
• NOTICE — copyright + third-party acknowledgements (stackvox via PyPI, terminal-notifier click-routing pattern, stackone-say-hooks phrase-pool seed)
• CHANGELOG.md — keep-a-changelog format with backfilled v0.1.0 / v0.2.0 / v0.3.0 entries
• LICENSE copyright line updated to "StackOne Technologies Ltd. and contributors"

GitHub configuration

• .github/PULL_REQUEST_TEMPLATE.md
• .github/ISSUE_TEMPLATE/{bug_report,feature_request,config}.yml — bug report captures stack-nudge specifics (agent, editor, config excerpts, log paths)
• .github/dependabot.yml — github-actions only (no SPM, no tracked Python deps)

CI (.github/workflows/ci.yml)

• shell — bash -n + shellcheck on every tracked .sh
• build-macos — runs build.sh for arm64 and x86_64 on macos-15, verifies the resulting Mach-O matches the matrix arch, lints both Info.plists with plutil
• Existing auto-tag.yml + release.yml workflows retained as-is

Misc

• .gitignore expanded (stack-nudge-panel.app, editor artefacts, *.log, /tmp/)

Out of scope (deliberate)

• No release-please / pre-commit / commitizen — stack-nudge has no Python toolchain in-repo and the existing tag-from-Info.plist release flow works. Can revisit in a follow-up if the value pays back.
• No mypy / pytest CI — no Python sources to lint or test (since the stackvox vendor cleanup).

Test plan

• bash -n passes on every shell script
• plutil -lint passes on both Info.plists
• ./build.sh produces working arm64 Mach-O binaries locally
• CI green on the PR (the shell and build-macos jobs run on every push / pull_request)

🤖 Generated with Claude Code