OSS hygiene sweep (one focused PR)

[spaceshipmike]

Mechanical gaps from the OSS-readiness audit. One focused PR covers all of it.

• Per-package READMEs for @setlist/core, @setlist/cli, @setlist/mcp — these are the npm-published faces and currently have none (only packages/app has one)
• Add repository fields to the three published package.jsons (https://github.com/spaceshipmike/setlist.git)
• Remove the personal dev hook from .claude/settings.json (statusline points at /Users/mike/Code/fctry/...)
• Anonymize or relocate scripts/digest-bakeoff-fixtures.json (absolute paths into personal repos)
• Remove the m4-pro.local default in packages/cli/src/digest.ts (also covered in the digest-provider issue — whichever lands first)
• SECURITY.md (private vulnerability reporting path)
• Issue templates: bug template requests setlist-doctor --json output + app version + OS; feature template asks for the experience, not the implementation
• Refresh stale CLAUDE.md (currently says spec 0.32 / 57 tools / beta.7; actual: spec 0.34 / 59 tools / schema v18 / beta.21)
• Decide on lint (no ESLint config today; typecheck only) — fine to explicitly punt, but record the decision