Community discoverability design

This change converts repository visitors into useful questions, reports, and contributions without adding a separate community platform.

Current gaps

The repository uses the canonical Fzkuji/OpenProgram contribution links, a public security policy, structured issue forms, and a link to GitHub Security Advisories for private vulnerability reports. These repository-visible contracts are implemented in .github/CONTRIBUTING.md, .github/SECURITY.md, .github/ISSUE_TEMPLATE/, and the pull-request template. Whether the external GitHub advisory setting is enabled is not established by repository files.

Reference behavior and decisions

• GitHub surfaces .github/CONTRIBUTING.md in repository contribution flows. Adopt one canonical guide with current setup and validation commands.
• GitHub recognizes issue forms under .github/ISSUE_TEMPLATE. Adopt separate bug and feature forms, route questions to Discussions, and disable blank public issues.
• GitHub recognizes .github/SECURITY.md and private vulnerability reporting. Adopt both so security reports are not disclosed in public Issues.
• Add a Contributor Covenant, support routing file, and pull-request template so GitHub can surface a complete community profile and contributors receive the same verification prompts.
• The public landing page links directly to Discussions and the contribution guide from its footer.
• Reject a new forum, chat server, form service, or bot; the existing GitHub surfaces cover the requirement and avoid another moderation channel.

Acceptance

• Every repository URL uses the canonical Fzkuji/OpenProgram path.
• Issue form YAML parses, contains the GitHub-required name and description fields, and routes support and security reports to the correct existing surfaces.
• Contribution, security, and issue-template links return successful responses.
• Private vulnerability reporting is enabled in repository settings.

Implementation evidence

• Pull request #4 merged to main as ac07ac5f after documentation, Web, and Python 3.11–3.13 CI passed.
• The publish workflow completed successfully, and the live landing page exposes Discussions and contribution links.
• GitHub reports a 100% community profile with the code of conduct, contribution guide, pull-request template, README, and license present.
• Private vulnerability reporting is enabled. The issue chooser routes bugs and feature requests through structured forms, questions to Discussions, and security reports to private advisories.