baseline: close 5 of 7 gaps (I10436) — SECURITY.md, templates, coverage-scope test, generated badges

[cipher813]

What & why

Closes the five clauses assigned to this session on alpha-engine-config-I10436 (repository-baseline-policy.md). RB-2.2/RB-2.2-hp (topics/homepage) and RB-6 (releases) are explicitly out of scope for this PR — owned elsewhere this session.

Clauses

Clause	Gap	Status	What changed
RB-3.2-sec	no SECURITY.md	Closed	SECURITY.md — GitHub Security Advisory + security@nousergon.ai, 72h ack / 14d fix window, tax-document/PII-specific scope
RB-3.2-pr	no PR template	Closed	.github/pull_request_template.md with the Prepared by: model-attribution footer (pull-request-policy.md §3)
RB-3.2-iss	no issue templates	Closed	.github/ISSUE_TEMPLATE/bug_report.md + feature_request.md, mirrored from morning-signal
RB-4.2-C5	scope unprotected	Closed	tests/test_coverage_scope.py — asserts --cov targets the whole telos package, exactly one fail_under at/above a pinned ratchet (98), no omit beyond an (empty) justified set, and no source module outside the measured package
RB-5.1	hand-set badges	Closed	License badge → img.shields.io/github/license/nousergon/telos (generated). Python-version badge dropped, not faked — telos is not published to PyPI (pypi.org/pypi/telos is an unrelated package), so no generated source exists for it. Added a Coverage badge sourced from a CI-published shields endpoint document

Measured numbers

• Local suite: 483 passed, 1 skipped.
• Coverage: 98.34% measured over the whole telos package (--cov=telos). Floor raised 90 → 98 as a ratchet (repository-baseline-policy.md §4.2 C3) — never lowered to pass a change.
• ruff check .: clean.

No post-merge step

Everything here is either applied in this PR or fires automatically from committed CI code on the next push to main:

• The badges orphan branch already exists on the remote (coverage.json = "pending" + a machine-written README), seeded before this PR was opened.
• .github/workflows/ci.yml's new "Publish coverage badge" step runs on the python-3.13 leg, push-to-main only, with job-level permissions: contents: write scoped to that one write — no operator action required. Merging this PR alone is sufficient; the coverage badge starts rendering a real number on the next push to main.

Test plan

• pytest --cov --cov-report=term-missing — 483 passed, 1 skipped, 98.34% ≥ 98% floor.
• pytest tests/test_coverage_scope.py -v — 5 passed; manually confirmed it fails if [tool.coverage.run] source is narrowed to a submodule.
• ruff check . — clean.
• CI matrix (3.11–3.14) unaffected by the coverage-scope test: it uses stdlib tomllib, and telos's requires-python = ">=3.11" covers every matrix leg (no tomli fallback needed, unlike a 3.10-inclusive repo).

Refs alpha-engine-config-I10436.

---

Prepared by: Claude Sonnet 5 via Claude Code