Complete public-repo security and contributor baseline

[Copilot]

This closes the remaining first-week public repository setup gaps: private security reporting guidance, contributor onboarding, Dependabot coverage for GitHub Actions, and an explicit repository-content hygiene decision for tracked generated docs.

• Security reporting

  • Add SECURITY.md with a private vulnerability disclosure path via GitHub advisories.
  • Document the expected contents of a report and the handling expectations for sensitive material.

• Contributor onboarding

  • Add CONTRIBUTING.md with project-specific setup, build, requirements/testing workflow, PR expectations, and public-repo hygiene guidance.
  • Call out the existing real-Pi verification and RFC 2119 requirements workflow so contributors follow repo-specific constraints instead of generic Xcode defaults.

• Dependency update coverage

  • Add .github/dependabot.yml for weekly GitHub Actions dependency updates.

• Tracked generated documentation policy

  • Record that docs/code-architecture-walkthrough.html is intentionally versioned durable documentation and should be updated alongside its Markdown sources, not treated as disposable output.

Example of the new automation coverage:

version: 2
updates:
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly

• Fixes Complete first-week repository security and contributor setup #3