Align CI with pyproject dev install and add CODE_OF_CONDUCT + SECURITY.md

[rosspeili]

Problem Statement

Skillware CI runs pip install -e ".[dev,all]", then black --check, flake8, pytest tests/ — same commands documented in TESTING.md and CONTRIBUTING. Rooms CI installs flake8/pytest ad hoc + flat requirements.txt, with no formatter gate.

Skillware also ships CODE_OF_CONDUCT.md (agent-aware) and SECURITY.md (supported versions, vulnerability reporting). Rooms has neither, which matters as we attract external contributors and prepare PyPI releases.

Proposed Solution

1. CI (after or in parallel with PyPI packaging issue):

   • Install via pip install -e ".[dev]" (or .[dev,memory] if tests need it)
   • Keep flake8 + pytest; optionally add black --check if we adopt Black (match Skillware)
   • Document exact CI commands in docs/TESTING.md

2. Add CODE_OF_CONDUCT.md — Contributor Covenant or Skillware-style Agent Code of Conduct adapted for Rooms (local-first, no data leakage, contribution process / co-authoring note).

3. Add SECURITY.md — report to systems@arpacorp.net (README support email), supported branch (main), pre-release disclaimer until first PyPI version.

4. GitHub repo settings: enable security policy link; optional Dependabot later (out of scope).

Acceptance criteria

• CI uses editable install from pyproject (blocked on packaging issue unless stub pyproject lands first)
• TESTING.md matches CI one-to-one
• CODE_OF_CONDUCT.md and SECURITY.md linked from CONTRIBUTING
• CHANGELOG entry when merged

Alternatives Considered

• CI-only issue without CoC/SECURITY — possible split; bundled here as "repo hygiene parity with Skillware."
• Ruff instead of flake8+black — rejected for v1; match Skillware toolchain unless maintainers prefer otherwise.

Priority

Medium 🟡

Additional Context

Skillware refs: .github/workflows/ci.yml, CODE_OF_CONDUCT.md, SECURITY.md, docs/TESTING.md.

Dependency: CI editable-install part blocked by PyPI packaging issue (#2 above); CoC/SECURITY can ship independently.