Add project Code of Conduct

[xeonvs]

Summary

• adopt Contributor Covenant 2.1 as the project's canonical community conduct policy;
• provide a confidential conduct-reporting route and link it from contributor entry points, package metadata, CODEOWNERS, and the issue chooser;
• finish the toolkit 0.6.0 update in the synthetic GitLab example by deriving its checksum URL and wheel install path from the single version pin;
• replace stale version-specific assertions with contracts tied to .release-version.

Why

The repository did not publish a Code of Conduct or a private route for conduct incidents. Separately, the previous example-version update changed only OCR_TOOLKIT_VERSION, leaving its checksum URL and installation filename pinned to an older release. This pull request closes both documentation consistency gaps without changing runtime behavior or publishing stable artifacts.

Validation

• scripts/quality.sh check — 766 passed, 99 subtests, 81.12% branch coverage
• scripts/gitleaks.sh
• focused documentation, integration, and publication-contract tests — 34 passed
• Ruff format and lint for changed tests
• YAML and TOML parsing
• Towncrier 0.6.1 draft rendering
• OCR support-manifest validation
• live readback of the v0.6.0 SHA256SUMS wheel entry
• complete branch diff and signed-commit self-review

Changed boundaries

Community governance/documentation and the public synthetic GitLab installation example. No runtime parser, persistence, Git, subprocess, provider mutation, reporting, or release-publication boundary changes.

Security and compatibility impact

Conduct reports are directed away from public issues to an existing confidential GitHub channel and explicitly distinguished from vulnerability classification. The GitLab example preserves checksum-locked wheel installation while eliminating independently drifting release literals. No credentials, private hosts, private repository details, environment contracts, Python support, or OCR compatibility decisions change.