SECURITY.md: private reporting via GitHub advisories with an email
fallback, a what-to-include checklist, response and disclosure policy, a
scope section (what is and is not a vulnerability, including stealth and
opt-in flags), third-party dependency handling, and the in-process
security model (V8 watchdog, CLI deadline, panic safety, default SSRF
egress block) with the note that it complements rather than replaces
OS-level isolation. Modeled on the Electron, Node, and Puppeteer policies.
CONTRIBUTING.md: code of conduct, an issue-first submission policy, build
and test workflow (nextest not cargo test, the 33/33 obstacle course
gate), the pre-PR checklist with performance as a hard constraint,
commit and PR conventions, and bug-report expectations. Points at
AGENTS.md for the deeper engine details instead of duplicating them.
