Add contributor, security and pull request scaffolding

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Every path is reviewed by the repository maintainer.
+* @landtml

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,20 @@
+---
+name: Bug report
+about: Report incorrect behaviour or a crash
+labels: bug
+---
+
+## What happened
+
+## What you expected
+
+## Minimal example
+
+```python
+```
+
+## Environment
+
+- finlab version:
+- Python version:
+- Operating system:

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,11 @@
+---
+name: Feature request
+about: Suggest a change or an addition
+labels: enhancement
+---
+
+## Problem
+
+## Proposed change
+
+## Alternatives considered

.github/pull_request_template.md

@@ -0,0 +1,19 @@
+## Summary
+
+<!-- What the change does, and why. -->
+
+## Changes
+
+-
+
+## Verification
+
+<!-- Commands run and their results. -->
+
+- `ruff check src tests tools benchmarks examples`:
+- `pytest -q`:
+
+## Changelog
+
+- [ ] The change is user-visible, and `CHANGELOG.md` has a line under `[Unreleased]`.
+- [ ] The change is not user-visible, so no changelog line is needed.

.gitignore

@@ -8,3 +8,6 @@ dist/
 *.nbi
 *.nbc
 .venv/
+.ruff_cache/
+.ipynb_checkpoints/
+.coverage

CONTRIBUTING.md

@@ -0,0 +1,33 @@
+# Contributing
+
+## Setup
+
+```bash
+python -m venv .venv
+. .venv/bin/activate
+pip install -e ".[dev,plot,notebooks]"
+```
+
+## Checks
+
+Run these before opening a pull request. CI runs the same commands.
+
+```bash
+ruff check src tests tools benchmarks examples
+pytest -q
+```
+
+## Pull requests
+
+- Work on a branch and open a pull request into `main`. Direct pushes to `main` are refused.
+- Fill in the pull request template: the change, the verification, and whether it needs a changelog line.
+- Commits must be authored from an address on the repository's allow-list, and must not carry a `Co-authored-by` trailer. The `commit-policy` check enforces both on every pull request.
+- A change that alters user-visible behaviour adds a line under `[Unreleased]` in `CHANGELOG.md`.
+
+## Releases
+
+See [RELEASING.md](RELEASING.md). A merge to `main` that changes the version in `pyproject.toml` is tagged and published by the release workflow.
+
+## Documentation
+
+Documentation lives in `docs/`, in the README, and in docstrings. Each claim in `docs/proofs/` either names the test that checks it or says how it is known.

SECURITY.md

@@ -0,0 +1,11 @@
+# Security policy
+
+## Reporting a vulnerability
+
+Report a suspected vulnerability privately through GitHub's private vulnerability reporting: open the repository's Security tab and choose "Report a vulnerability". Do not open a public issue for a vulnerability.
+
+Include the affected version, the impact, and the steps to reproduce.
+
+## Supported versions
+
+Only the latest release receives fixes.