Add a contributing guide

[jrwesolo]

Adds CONTRIBUTING.md. There was no contributor documentation, so the setup, the test commands, and the conventions CI enforces were only discoverable by reading .github/workflows/ci.yml and the scripts next to it.

What it covers

• Installing Cinc Workstation, with a pointer to TESTING.md for the pinned versions rather than duplicating them
• The three test commands, and that integration tests need Docker
• A table of what lives where, libraries/ against resources/, and which tests cover which
• Why there are no ChefSpec tests, which otherwise reads as an oversight rather than a decision
• Versioning, changelog format, what each CI job checks, and pull request expectations
• That releases are automated and contributors need not tag or publish anything

Placement

The file is at the repository root rather than under .github/. GitHub honours either for its own UI prompt, but Supermarket's quality metric does not:

repo_contents = octokit_client.contents(repo)
!repo_contents.any? { |file| file.with_indifferent_access["name"] =~ /^contributing\.md$/i }

octokit_client.contents(repo) with no path lists the root only, so a file under .github/ would fail the metric.

Not in the published artifact

chefignore already carries CONTRIBUTING*, verified against the glob list directly: CONTRIBUTING.md is excluded alongside TESTING.md and CHANGELOG.md, while README.md, LICENSE, metadata.rb, libraries/ and resources/ still publish. The Supermarket metric reads the GitHub repository rather than the tarball, so excluding it costs nothing.

Testing

Documentation only, no cookbook code changed. cookstyle 17 files no offenses, rspec 66 examples 0 failures.

Resource names and paths used as examples were checked against resources/*.rb and the tree rather than written from memory. Link references and code fences verified balanced and all resolving. Spelling follows the repository's existing US convention, matching LICENSE and license 'MIT' in metadata.rb.

No version bump and no changelog entry, since nothing user-visible changed. This is the case the version job is built to skip.