[codex] contributor-friendly foundation - #168

Linked issue / agreed scope

This PR implements the agreed contributor-friendly foundation plan. It keeps the compatibility-sensitive rename work tracked by #128 out of scope and advertises only the concrete contributor-ready work in #145 and #146.

Change summary

Forkara's contributor path had accumulated stale Synara branding, hostile or ambiguous policy language, a public vouch system, duplicated label definitions, and no safe development preset for running beside an installed app. Together, those gaps made routine contributions require maintainer assistance and made the public workflow harder to understand than the project intends.

This change replaces that path with warm, direct onboarding and a curated issue-first lifecycle built around monthly triage. It adds a development guide, security policy, documentation issue form, support and security routing, a concise PR template, and a single label-definition workflow. It removes the vouch list and workflow while retaining GitHub's built-in first-time contributor approval behavior.

The new bun run dev:contributor preset reuses the existing development runner while forcing repository-local ignored state, non-default ports, and no inherited server auth token. Live provider credentials are documented as optional for ordinary UI and unit work.

Active onboarding documentation now uses Forkara branding and current links. Intentional compatibility identifiers and archived or release-specific material remain unchanged under #128.

Verification

• bun run fmt -- '!ui-review-report.md'
• bun run lint (zero errors)
• bun run typecheck
• TURBO_ENV_MODE=loose TMPDIR=/private/tmp bun run test (all 8 workspace tasks passed; server: 4,198 passed, web: 4,272 passed)
• bun run --cwd scripts test dev-runner.test.ts (26 passed)
• bun run dev:contributor -- --dry-run
• bun run readme:truthiness
• bun run brand:check
• YAML parsing for all issue forms and workflows
• Clean-checkout bun install --frozen-lockfile, contributor dry-run, and focused runner test

The loose Turbo environment mode passes macOS's canonical /private/tmp value through to two existing reset-department tests that otherwise compare /tmp with /private/tmp.

Compatibility risks

No runtime APIs, persisted schemas, or shared application contracts change. Existing development modes retain their prior inputs and behavior. The contributor preset intentionally ignores inherited auth and explicit state or port overrides so it remains isolated and predictable.

Compatibility-sensitive SYNARA_*, .synara, and provider protocol identifiers remain in place.

After this PR merges, the repository-label workflow should be dispatched and the default-branch ruleset should be created with the four always-running CI checks. The ruleset is intentionally not enabled before its defining PR merges.

UI evidence

Not applicable. This PR changes documentation, contributor forms, repository automation, and development-runner behavior without changing the product UI.