docs: say how claiming an issue actually works

.github/ISSUE_TEMPLATE/bug_report.md

@@ -40,3 +40,7 @@ Provide a minimal reproduction if possible.
 ## Relevant files or output
 
 Paste relevant output, stack traces, or snippets here.
+
+---
+
+_Before starting work on this, comment here so others can see. The first working pull request is the one that lands._

.github/ISSUE_TEMPLATE/feature_request.md

@@ -31,3 +31,7 @@ Describe any alternatives you considered.
 ## Additional context
 
 Add examples, screenshots, or CLI output if relevant.
+
+---
+
+_Before starting work on this, comment here so others can see. The first working pull request is the one that lands._

.github/ISSUE_TEMPLATE/first_timers_only.md

@@ -0,0 +1,39 @@
+---
+name: First-timers-only issue
+about: A small, well-scoped task aimed at someone making their first open source contribution
+title: ""
+labels: first-timers-only, good first issue, help wanted
+assignees: ""
+
+---
+
+This one is aimed at people who have not contributed to open source before. If that is
+not you, please leave it for someone who has. There are other issues labelled
+[`good first issue`](https://github.com/OWASP/cve-lite-cli/labels/good%20first%20issue)
+that are open to anyone.
+
+## The task
+
+Describe what needs doing, in enough detail that no design decisions are left open.
+
+## Where to look
+
+Name the files involved and what each one does.
+
+## Steps
+
+1. Comment here so other people can see someone is on it.
+2. Fork the repo and create a branch.
+3. Make the change.
+4. Run `npm test` and `npm run build`.
+5. Open a pull request with `Closes #NNN` in the body.
+
+## If you get stuck
+
+Ask in this thread. A half-finished attempt with a question attached is welcome, and there
+is no time limit on this.
+
+---
+
+_The first working pull request is the one that lands. Commenting first is a courtesy to
+other contributors, not a reservation._

CONTRIBUTING.md

@@ -14,6 +14,13 @@ All contributions to this project are voluntary and unpaid. By opening a pull re
 4. Make your changes, add tests, and run the verification sequence under [Code standards](#code-standards).
 5. Open a pull request with `Closes #NNN` in the body.
 
+You do not need permission to start. Step 2 is a courtesy so other people can see someone
+is on it, not a reservation.
+
+If two people end up working on the same thing, the first working pull request is the one
+that lands. If you get there second, tell us anyway: we credit the people who reported and
+diagnosed a problem in the release notes, not only the author of the merged PR.
+
 ## Code standards
 
 - Run this sequence before submitting. It matches CI exactly. PRs with failing tests will not be merged.