Prepare community skills for public contributions

[jrusso1020]

What

• replace private-repository install guidance with public HTTPS instructions
• add a security policy and private vulnerability-reporting route
• add a Contributor Covenant-based code of conduct
• add structured bug-report and skill-proposal issue forms
• add weekly dependency updates for the first skill's npm dependencies
• document fork-based and AI-assisted contribution expectations

Live repository settings applied

• added a public description and discovery topics
• disabled unused wiki and projects surfaces
• enabled secret scanning, push protection, Dependabot security updates, and private vulnerability reporting
• restricted Actions to read-only workflow tokens, GitHub-owned actions, and the pinned TruffleHog action
• made squash the only merge method and enabled automatic branch cleanup
• protected the default branch with no bypass, one fresh CODEOWNER approval, resolved conversations, signed commits, an up-to-date branch, and the required Structure and safety check

Verification

• repository validator passes with 1 skill
• all GitHub YAML parses successfully
• staged diff passes git diff --check
• live settings were read back through the GitHub API

This PR is expected to require an independent CODEOWNER approval under the new rules.