docs: say what is welcome in a generated repo, and where it goes

[jothimani-rajendran]

What

README only, the one hand-written file here. The README said pull requests are closed and did not say what is welcome. A Contributing section now answers that with a four-row table: policy changes go to the catalog, "the guard did / did not block on my Copilot CLI or VS Code version" reports go to chock (which carries the witnessed-blocking claims these packages state), generator bugs go to chock, and README fixes belong here. A "Part of the open-coder-ai family" table before the license lists the sibling repositories with their roles; the same table lands in every public repository of the organisation.

The generated-only check is unaffected: README.md is not written by chock marketplace build (that writes PLUGINS.md), so regenerating from the catalog produces no diff. No package, hook, lockfile or posture statement changes.

🤖 Generated with Claude Code

---

Generated by Claude Code

[jothimani-rajendran]

Generated-only / verify is red on this PR, and it is red on main for the same reason, not because of this change.

What fails: the first step, chock marketplace build --dist . --check, reports differs: PLUGINS.md. README.md is not an input to that build (the publisher writes PLUGINS.md, marketplace.json and the lockfile), so the diff here cannot move the result.

Why it is red on main: the workflow installs the framework from its floating main, which is now 0.8.0, and the catalog's .framework-ref now says v0.8.0; this tree was published from v0.7.0. The 0.8.0 emitter rewrote the preamble of PLUGINS.md (the fail-open sentence now also states the ask/deny posture when the guard crashes). Running the same check locally on main (6c2d6e7) with framework 0.8.0 fails identically; the sibling chock-claude-plugins repository shows the same step failing on its push to main on 2026-09-01, a week before this PR.

The fix: a republish via publish.yml at the catalog's current ref, which rewrites PLUGINS.md and the packages together. That is a release action, and hand-committing a regenerated PLUGINS.md into a README PR would be exactly the drift this check exists to catch, so nothing is ported here. No re-run is requested: the failure is deterministic and reproduces locally.

---

Generated by Claude Code