chore: add public contribution governance

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Require repository-owner review for every change.
+* @barbatdev

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,32 @@
+name: Bug report
+description: Report broken behavior in the dotfiles or installer.
+title: "[Bug]: "
+labels: ["bug", "needs-triage"]
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: What happened?
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: Include commands and relevant environment details, but do not include secrets or private paths.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: validation
+    attributes:
+      label: Checks already run
+      description: For example, `bash install.sh --check` or `scripts/oss-audit.sh`.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/change_request.yml

@@ -0,0 +1,39 @@
+name: Change request
+description: Propose a focused change before opening a pull request.
+title: "[Change]: "
+labels: ["needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Please open an issue before a PR. PRs without an agreed issue may be closed.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What should change, and why?
+    validations:
+      required: true
+  - type: textarea
+    id: proposed-scope
+    attributes:
+      label: Proposed scope
+      description: What files or behavior do you expect to touch?
+    validations:
+      required: true
+  - type: textarea
+    id: safety
+    attributes:
+      label: Public safety considerations
+      description: Note any installer, shell, AI CLI, package-manager, or private-data exposure risks.
+    validations:
+      required: true
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Checklist
+      options:
+        - label: I understand changes must go through a pull request and maintainer review before merge.
+          required: true
+        - label: I will not include secrets, private paths, private hostnames, private IPs, real emails, or machine-specific values.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security issue
+    url: https://github.com/barbatdev/cortex-dots/blob/main/SECURITY.md
+    about: Please read the security policy before reporting secrets, credential exposure, or command-injection findings.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,22 @@
+## Summary
+
+- 
+
+## Linked Issue
+
+Fixes #
+
+## Validation
+
+- [ ] `scripts/oss-audit.sh`
+- [ ] Relevant syntax/config checks from `README.md`
+
+## Public Safety Checklist
+
+- [ ] No secrets, tokens, private keys, real emails, private hostnames, private IPs, customer names, or machine-specific paths.
+- [ ] Local/private values remain in `~/.config/cortex-dots/local/env.zsh` or another untracked local file.
+- [ ] Installer, shell, AI CLI, and package-manager changes were reviewed for security impact.
+
+## Notes
+
+- 

CONTRIBUTING.md

@@ -0,0 +1,45 @@
+# Contributing
+
+Thanks for helping improve `cortex-dots`. This repository is public, but changes are intentionally gated because these dotfiles affect local shells, developer tooling, package-manager defaults, and AI CLI behavior.
+
+## Contribution Flow
+
+1. Open an issue before starting work.
+2. Wait for maintainer agreement on the scope.
+3. Open a pull request linked to the issue.
+4. Keep the PR focused on one change.
+5. Wait for maintainer review before merge.
+
+Maintainers may close PRs that do not have a linked issue or that expand beyond the agreed scope.
+
+## What Needs Review
+
+All changes to `main` require maintainer review. This is especially important for:
+
+- Shell startup files and helper scripts.
+- Installer behavior.
+- Package-manager configuration.
+- AI CLI configuration or permission flags.
+- GitHub Actions and repository governance files.
+- Any file that could expose private paths, hostnames, emails, tokens, or machine-specific data.
+
+## Public Safety Rules
+
+- Do not commit secrets, tokens, private keys, real emails, private hostnames, private IPs, customer names, or machine-specific paths.
+- Put local/private values in `~/.config/cortex-dots/local/env.zsh`.
+- Keep examples generic and placeholder-based.
+- Run `scripts/oss-audit.sh` before opening a PR.
+- Run the validation commands listed in `README.md` when touching scripts or config formats.
+
+## Pull Request Expectations
+
+Every PR should include:
+
+- A linked issue, using `Fixes #123`, `Closes #123`, or `Refs #123`.
+- A short summary of the change.
+- Validation performed.
+- Any security or public-exposure considerations.
+
+## Maintainer Merge Policy
+
+Only maintainers merge to `main`. PRs should be merged only after the repository owner has reviewed and approved the change.