fix: P0/P1/P2 audit fixes, CI verification build, and developer docs

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,148 @@
+name: Bug report
+description: Something is broken, crashing, or behaving incorrectly on a device
+title: "[Bug] "
+labels: ["bug", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to report this. Gothwad Launcher runs on TV boxes and set-top
+        boxes whose firmware differs far more than phone firmware does, so the device details below
+        are **not** optional boilerplate — they usually decide whether a bug is reproducible.
+
+        Before filing, check [docs/TROUBLESHOOTING.md](https://github.com/GothwadTech/launcher/blob/main/docs/TROUBLESHOOTING.md):
+        boot ads, safe-mode toasts, giant/tiny UI, "app lock doesn't work from recents", "Quick
+        Dashboard says Remote: unknown" and self-update install failures are all covered there.
+
+  - type: textarea
+    id: summary
+    attributes:
+      label: What happened?
+      description: One or two sentences describing the incorrect behaviour.
+      placeholder: After the box wakes from standby, the home grid is empty until I press Back.
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: The exact sequence. Include anything you pressed on the remote.
+      placeholder: |
+        1. Set the launcher as default home
+        2. Press power to standby
+        3. Press power to wake
+        4. Grid is empty
+      value: |
+        1.
+        2.
+        3.
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: What did you expect instead?
+    validations:
+      required: true
+
+  - type: input
+    id: device
+    attributes:
+      label: Device, Android version and build
+      description: |
+        The box/TV model (not "an Android TV") plus Settings → About. Include the firmware or
+        build number if you can find it — it often decides whether a bug is reproducible.
+      placeholder: Xiaomi Mi Box S 2nd gen, Android 11, build QTG1.200615.002
+    validations:
+      required: true
+
+  - type: dropdown
+    id: install
+    attributes:
+      label: How was the launcher installed?
+      description: Debug and release builds are signed with different keys and behave differently on update.
+      options:
+        - GitHub Release APK (signed release)
+        - Google Play Store
+        - F-Droid
+        - Self-built debug APK (./gradlew assembleDebug)
+        - Self-built release APK (-PlocalSign or own keystore)
+        - Pre-installed by the vendor
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: Launcher version
+      description: Settings → About shows it.
+      placeholder: 1.0.6 (versionCode 10006)
+    validations:
+      required: true
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Which area is affected?
+      multiple: true
+      options:
+        - Home grid / app list
+        - Status bar
+        - Wallpapers & appearance
+        - App lock / hidden apps (vault)
+        - Quick Dashboard
+        - Search / voice search
+        - Settings sheet
+        - Remote button mapping
+        - Boot behaviour / boot ads / watchdog
+        - Self-update
+        - Performance / memory / crashes
+        - Other
+
+  - type: dropdown
+    id: a11y
+    attributes:
+      label: Is the accessibility service enabled?
+      description: "Settings → Accessibility → Gothwad Launcher. Lock enforcement outside the home grid depends on it."
+      options:
+        - "Yes"
+        - "No"
+        - "It turns itself off after a reboot"
+        - "Not sure how to check"
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: |
+        Run these and paste the output inside the code fences. `run-as` needs a debuggable build.
+
+        ```
+        adb shell run-as com.gothwad.launcher cat files/gothwad_crash.log
+        adb logcat -d | grep -iE "gothwad|AndroidRuntime"
+        ```
+      render: shell
+
+  - type: textarea
+    id: media
+    attributes:
+      label: Screen recording or photos
+      description: |
+        For anything visual (rendering, scaling, flicker, overlays) a photo of the TV is more useful
+        than a description. Drag files in here.
+
+  - type: checkboxes
+    id: terms
+    attributes:
+      label: Final checks
+      options:
+        - label: I checked docs/TROUBLESHOOTING.md and this is not already covered there
+          required: true
+        - label: I searched existing issues (open and closed) for this symptom
+          required: true
+        - label: This report contains no credentials, PINs or reveal codes
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,21 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Troubleshooting guide
+    url: https://github.com/GothwadTech/launcher/blob/main/docs/TROUBLESHOOTING.md
+    about: >
+      Boot ads, safe-mode toasts, wrong UI size, app lock not working from recents,
+      "Remote: unknown" in the dashboard, self-update install failures — read this first.
+  - name: Roadmap & known gaps
+    url: https://github.com/GothwadTech/launcher/blob/main/docs/ROADMAP.md
+    about: Already-planned work, why it has not landed, and the explicit non-goals.
+  - name: Configuration reference
+    url: https://github.com/GothwadTech/launcher/blob/main/docs/CONFIG.md
+    about: Every persisted setting — type, default, what reads it, which screen writes it.
+  - name: Security & privacy
+    url: https://github.com/GothwadTech/launcher/blob/main/docs/SECURITY.md
+    about: >
+      How locks and credentials work, what each permission is for, and what is NOT collected.
+      For a lock bypass or credential leak, do not open a public issue — contact the maintainers.
+  - name: Contributing guide
+    url: https://github.com/GothwadTech/launcher/blob/main/CONTRIBUTING.md
+    about: Ground rules (no Compose, no main-thread blocking), PR checklist, local build commands.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,88 @@
+name: Feature request
+description: Suggest a new capability or an improvement
+title: "[Feature] "
+labels: ["enhancement", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Please read [docs/ROADMAP.md](https://github.com/GothwadTech/launcher/blob/main/docs/ROADMAP.md)
+        first — your idea may already be scoped there, including the reason it has not been built
+        yet. Note the explicit non-goals: Jetpack Compose, cloud sync or accounts, analytics, and
+        content widgets (weather, scores) will not be accepted.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem does this solve?
+      description: Describe the situation, not the solution. "I can't reach X from the couch" beats "add a button".
+      placeholder: After the box wakes from standby I have to scroll the whole grid to find the app I was using.
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: What would you like to happen?
+      description: Describe the behaviour you want, including where it lives in the UI and how it is reached with a remote.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives you considered or workarounds you use today
+      description: Include other launchers or apps that do this well, and what they do differently.
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Which area would this touch?
+      multiple: true
+      options:
+        - Home grid / app list
+        - Status bar
+        - Wallpapers & appearance
+        - App lock / hidden apps (vault)
+        - Quick Dashboard
+        - Search / voice search
+        - Settings sheet
+        - Remote button mapping
+        - Boot behaviour / watchdog
+        - Self-update
+        - Performance / memory
+        - New area entirely
+
+  - type: dropdown
+    id: cost
+    attributes:
+      label: What would this cost on a 2 GB box?
+      description: |
+        Every feature pays in memory, startup time or a new permission. Being honest here speeds up
+        triage considerably — "I don't know" is a fine answer.
+      options:
+        - No new permission, no measurable memory or startup cost
+        - Needs a new permission (say which in the notes)
+        - Needs extra memory or a bigger startup path
+        - Needs network access beyond the existing update check
+        - I don't know
+    validations:
+      required: true
+
+  - type: textarea
+    id: notes
+    attributes:
+      label: Notes
+      description: Permissions required, firmware quirks you have seen, mockups, links.
+
+  - type: checkboxes
+    id: terms
+    attributes:
+      label: Final checks
+      options:
+        - label: I checked docs/ROADMAP.md and this is not already listed or explicitly a non-goal
+          required: true
+        - label: I searched existing issues (open and closed) for this request
+          required: true
+        - label: This feature can be built with native Android Views — no Jetpack Compose
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,55 @@
+<!--
+Thanks for the pull request. Please fill in the sections below rather than deleting them.
+The checklist maps to the rules in AGENTS.md and CONTRIBUTING.md; a reviewer will check it
+against the diff.
+-->
+
+## What does this change?
+
+<!-- One or two sentences. Link the issue it fixes: "Fixes #123". -->
+
+## Why?
+
+<!-- The user-visible problem. If it is a performance or memory change, include the numbers. -->
+
+## How did you verify it?
+
+<!--
+Be concrete. For anything visual or firmware-dependent, name the device.
+"I ran it in my head" is not verification, and this project has no local Android SDK for some
+contributors — say so and lean on CI plus a device you do have.
+-->
+
+- Device / firmware:
+- Build installed (`assembleDebug`, GitHub Release APK, …):
+- What you did and what happened:
+- Unit tests added / run:
+
+## Screenshots or recordings
+
+<!-- Drag files in. Required for any visual change. -->
+
+## Checklist
+
+- [ ] **No Jetpack Compose** — no `androidx.compose.*` import, no `@Composable`, no
+      `ComposeView`, no `buildFeatures { compose = true }` (AGENTS.md)
+- [ ] No blocking work added to the main thread (no PackageManager queries, bitmap decode or
+      `Runtime.exec` outside a background dispatcher)
+- [ ] Only the main process touches `ConfigStore`; any cross-process state goes through
+      `ProcessHeartbeat` in device-protected storage
+- [ ] Security decisions stay in their single owner (`AppLockGate`, the accessibility service,
+      `LockSecurity`) and fail **secure**, never open
+- [ ] No invented device state — unknown is reported as unknown
+- [ ] New/changed `LauncherConfig` fields documented in `docs/CONFIG.md` (and defaulted, never
+      nullable)
+- [ ] `CHANGELOG.md` updated under **Unreleased**
+- [ ] User-visible strings are resources in `values/strings.xml` (docs/I18N.md)
+- [ ] Newer-than-API-21 calls are guarded (`minSdk 21`)
+- [ ] `./gradlew assembleDebug testDebugUnitTest lintDebug` passes locally
+- [ ] `./gradlew assembleRelease` passes (R8/minification is a separate failure mode)
+- [ ] Docs that this change invalidates were updated (`docs/ARCHITECTURE.md`, `docs/SECURITY.md`,
+      `docs/PERFORMANCE.md`, `README.md`)
+
+## Notes for the reviewer
+
+<!-- Anything subtle, anything you are unsure about, anything you deliberately did NOT do. -->