docs: add the community health files that the rewritten README links

[Wahbeh-Mohammad]

Summary

#57 rewrites the root README.md against the shape of dexpace/python-sdk. That README
links five files at the repository root. This repository has none of them. Add the files,
or the new README ships with dead links.

Two repositories should agree here. A contributor who moves between the Python SDK and
the Node.js SDK should find the same documents in the same places.

Current gap

File	dexpace/python-sdk	dexpace/nodejs-sdk
CONTRIBUTING.md	2199 B	missing
CODE_OF_CONDUCT.md	1537 B	missing
SECURITY.md	1348 B	missing
CHANGELOG.md	10317 B	missing
LICENSE.md	1084 B	present as LICENSE, without an extension
.github/ISSUE_TEMPLATE/	bug_report.yml, feature_request.yml, config.yml	missing
.github/PULL_REQUEST_TEMPLATE.md	present	missing
.github/dependabot.yml	present	missing

.github/ in this repository holds workflows/ and nothing else.

Work items

1. CONTRIBUTING.md

Port the section order from python-sdk: Setup, Quality gates, Conventions, Commit
messages, Reporting issues.

The content differs, because the toolchain differs. State the Node.js facts:

• bun install --frozen-lockfile, and the Bun version pinned in .bun-version.
• The gate list. Every step in .github/workflows/ci.yml blocks a merge. There are 13
  of them.
• node .claude/skills/ci-preflight/run-ci.mjs --clean runs the whole set locally.
• A consumer-facing change needs a changeset. Use bun run changeset, not
  bunx changeset. The wrapper renames the generated file.
• A change to a package's exports needs a regenerated API report. Run api:local in
  that package and commit the result.

2. CODE_OF_CONDUCT.md

Copy from python-sdk. Change the repository name and the contact address. The Python
file follows the Contributor Covenant and has the sections Our pledge, Our standards,
Enforcement, and Attribution.

3. SECURITY.md

Copy the shape from python-sdk: Supported versions, Reporting a vulnerability, Scope
notes. Update the supported-version table for this repository. No version has shipped
yet; every package is at 0.0.0.

4. CHANGELOG.md

This one needs a decision. This repository uses Changesets. Changesets writes a
CHANGELOG.md into each package on release, not one file at the root. The Python SDK
keeps a single hand-written file at the root.

Two options:

• Let Changesets own the per-package files, and make the root CHANGELOG.md a short
  pointer to them.
• Keep a hand-written aggregate at the root, and accept that it duplicates the
  per-package files.

The first option matches the tool. The second matches python-sdk. Pick one before the
README links it.

5. Rename LICENSE to LICENSE.md

git mv LICENSE LICENSE.md.

Low risk. Nothing in the repository reads the file by name. Every package manifest
carries the SPDX string "license": "MIT", which does not depend on the file name. npm
includes a licence file in the published tarball whatever its extension, so the files
arrays need no change. GitHub already detects the licence as MIT and will continue to.

While there: the root package.json has no license field. Add "license": "MIT" for
consistency with the nine package manifests.

6. .github/ templates (optional)

Port ISSUE_TEMPLATE/bug_report.yml, ISSUE_TEMPLATE/feature_request.yml,
ISSUE_TEMPLATE/config.yml, and PULL_REQUEST_TEMPLATE.md from python-sdk. Adjust
the environment fields; ask for the Bun version and the Node.js version instead of the
Python version.

dependabot.yml is a separate call. Bun lockfiles and Dependabot do not work well
together today. Confirm the support state before you add the file.

Out of scope

• The docs/ restructure and the README rewrite. Those are docs: restructure docs/ into frozen references + docs/work/mvp, and add a housekeeping skill to prevent drift #57.
• Any change to docs/knowledge/, docs/product-spec/, or docs/sdk-design-nodejs/.

Acceptance criteria

• CONTRIBUTING.md, CODE_OF_CONDUCT.md, and SECURITY.md exist at the repository
  root and describe this repository, not the Python one.
• The CHANGELOG.md decision is recorded in this ticket, and the chosen file exists.
• LICENSE.md exists. LICENSE no longer does. GitHub still reports the licence as
  MIT.
• The root package.json carries "license": "MIT".
• Every link in the rewritten README.md resolves.
• Every gate in .github/workflows/ci.yml still passes. Run
  node .claude/skills/ci-preflight/run-ci.mjs --clean.

Open decisions

1. The CHANGELOG.md shape. See work item 4.
2. The contact address for SECURITY.md and CODE_OF_CONDUCT.md. The .github profile
   repository lists oaljarrah@dexpace.org. Confirm that a security report should go to
   the same address, or open a GitHub private vulnerability report instead.
3. Whether the .github/ templates land in this ticket or in a separate one.

---

Related to #57. #57 should not link these files until this ticket lands.