Add issue forms and PR template

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,66 @@
+name: Bug report
+description: A defect in the library, or a CVE Record that validates incorrectly
+labels: ["bug"]
+body:
+  - type: dropdown
+    id: kind
+    attributes:
+      label: What kind of problem is this?
+      options:
+        - A record is accepted that should be rejected
+        - A record is rejected that should be accepted
+        - The library errors, crashes, or won't build/install
+        - Something else
+    validations:
+      required: true
+
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: What happened, and what did you expect instead?
+    validations:
+      required: true
+
+  - type: dropdown
+    id: method
+    attributes:
+      label: Validation method
+      options:
+        - validateCveRecord
+        - validatePublishedCveCnaContainer
+        - validateRejectedCveCnaContainer
+        - validatePublishedCveCnaContainerSchema
+        - validateRejectedCveCnaContainerSchema
+        - Not applicable
+
+  - type: textarea
+    id: input
+    attributes:
+      label: Minimal input
+      description: The smallest CVE Record or CNA Container that reproduces this. Redact anything non-public.
+      render: json
+
+  - type: textarea
+    id: diagnostics
+    attributes:
+      label: Diagnostics output
+      description: The full Diagnostics object the library returned.
+      render: json
+
+  - type: input
+    id: version
+    attributes:
+      label: Library version
+      description: Branch, tag, or commit you installed from.
+      placeholder: main @ 4f3c1a2
+    validations:
+      required: true
+
+  - type: input
+    id: node
+    attributes:
+      label: Node.js version
+      description: Output of `node --version`. Supported range is >= 24.13.0 < 25.
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,34 @@
+name: Feature request
+description: Suggest a capability or change to this library
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+      description: What should the library do that it doesn't do today?
+    validations:
+      required: true
+
+  - type: textarea
+    id: motivation
+    attributes:
+      label: Motivation
+      description: Who needs this — CNAs, the Secretariat, downstream consumers — and what are they doing today instead?
+    validations:
+      required: true
+
+  - type: textarea
+    id: api
+    attributes:
+      label: Proposed API
+      description: If this adds or changes an export, sketch the call and its return shape.
+      render: typescript
+
+  - type: checkboxes
+    id: scope
+    attributes:
+      label: Scope check
+      options:
+        - label: This is about the library, not the CVE Record schema itself
+        - label: This is about the library, not CVE Program rules or policy

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,23 @@
+## Summary
+
+<!-- What changes and why. One paragraph. -->
+
+Closes #
+
+## Changes
+
+<!-- Notable files or exports touched, and what changed in each. -->
+
+## Validation impact
+
+<!-- Does this change what the library accepts or rejects? If yes, describe
+     which records are affected and whether it is a schema-level or
+     rules-level change. If no, say "None". -->
+
+## Checklist
+
+- [ ] `npm run typecheck` passes
+- [ ] `npm run build` succeeds
+- [ ] `npm run test:local` passes
+- [ ] Public exports in `src/index.ts` and the README `Exports` list still agree
+- [ ] README updated if usage or `Diagnostics` output changed