docs: establish the OSS contribution front door

[morgmart]

Summary

Berd is public, but its front door was still template text. CONTRIBUTING.md was a single link to Block's generic guidelines, the README pointed at it, and nothing told an outside reader what we accept.

We accept issues, not outside pull requests. This makes that explicit and raises the bar on what an issue has to contain — the goal is that filing one requires actually thinking it through.

What changed

CONTRIBUTING.md is now the source of truth for participating. The no-outside-PR policy and the reasoning behind it, what a bug report and a feature request each require, and how triage works. It deliberately doubles as the agent-followable spec: one file, browsable on github.com and fetchable as raw markdown, so a reporter's agent reads the same rules a human does. No wiki, no Discussions post, no separate docs site to drift.

Issue templates converted from markdown to YAML forms. Markdown headings are deletable suggestions; forms have genuinely required fields.

• Bug reports require repro steps, expected and actual as separate fields, frequency, version, platform, model/provider, and log output. Log paths are documented per-platform, including the Goose backend state dir for agent-side problems.
• Feature requests require the problem in user terms, the current workaround, why it belongs in core rather than a skill/agent/extension, and non-goals. Those last two do most of the filtering.

blank_issues_enabled: false so the forms can't be bypassed, with contact links routing questions and security reports elsewhere.

Restore CODEOWNERS. This is the load-bearing one: main already has branch protection requiring code-owner review, but the OSS port dropped the file — so that rule matched nobody and passed trivially. Set to @block/berd-oss-team.

Add close-external-prs.yml. GitHub gives no way to prevent PRs on a public repo, so outside PRs get a polite comment pointing at CONTRIBUTING.md and an immediate close. It checks real collaborator permission via the API rather than trusting author_association, which reads as CONTRIBUTOR for maintainers whose org membership is private. Uses pull_request_target for write access on fork PRs and never checks out or runs PR code.

PR template leads with the policy so it's seen before submitting, not after.

Testing

• Both issue forms parsed and validated against GitHub's form schema — field types, unique ids, required options, no validations on markdown blocks. Bug: 12 fields / 10 required. Feature: 10 fields / 7 required.
• All four YAML files parse.
• Every external URL returns 200; every in-repo file reference and every CONTRIBUTING.md TOC anchor resolves.
• Log paths verified against src-tauri rather than guessed — Tauri's app_log_dir puts macOS logs in ~/Library/Logs/, not Application Support, which is what I'd assumed at first. Settings → About confirmed as the version location via AboutSettings.tsx.
• Local just pre-push suite green: fmt-check, check, tauri-check, clippy, berdctl-contract-check.

Notes for review

• Created the needs-info label on the repo, since the documented triage flow refers to it and it didn't exist. bug and enhancement already did.
• Discussions stays off — issue comments cover the same ground and it's one less surface to tend.
• The in-app feedback flow posts to an internal Block endpoint, so external reporters are pointed at manual log paths instead.
• Still needs a maintainer with admin: nothing here can enforce itself if CODEOWNERS is scoped wrong, so please sanity-check that @block/berd-oss-team is the right owning team.

Architecture review

Spar reviewed the actual branch, repo laws, current access model, and fresh reference implementations. Verdict: this makes sense to try after four corrections, now addressed:

1. Defined eligible PR authors consistently as authorized repository collaborators (write or higher), matching the actual GitHub access boundary. This includes the deliberately authorized contributor team rather than coupling automation to one org team name.
2. Removed the blanket Bot exemption. Bots now need write access like any other author.
3. Pinned both third-party Actions to full commit SHAs. pull_request_target remains API-only and never executes PR code.
4. Stopped describing issue forms as API-level enforcement. They are the required supported UI path; issues that bypass them through an agent/API remain subject to the same policy at triage.
5. Clarified needs-info ownership: any activity resets the countdown, but only a maintainer removes needs-info after judging the answer sufficient.

The PR now also includes the 30-day needs-info lifecycle: warn after around 23 inactive days, close 7 days later, PRs and all other issues exempt, restricted to block/berd, and manually dispatchable. The warning uses a distinct closing-soon state rather than overloading needs-info.

Repository-setting changes made alongside this PR:

• Created needs-info and closing-soon labels.
• Deleted unused good first issue and help wanted labels because both advertise a contribution path Berd explicitly does not offer. Neither had any issue attached.