chore: establish public repository standards

[songoao25]

Summary

• establish public-fork metadata while retaining upstream author attribution and MIT license
• document the host-only configuration boundary and no-global-settings-page policy
• add CI, CodeQL, Dependabot, issue and pull-request templates, security and contribution guidance
• add a package contract regression test

Verification

• npm test
• npm pack --dry-run
• git diff --check