docs: make CONTRIBUTING describe what the project actually does (closes #34, #30)

[snad1]

What & why

CONTRIBUTING described a project this is not. Two tracked issues, both closed here.

§1/§3 promised release automation that was never built (#34). "Conventional Commits …
drives the automated changelog and version bumps", and the flow diagram ended
→ auto changelog + version → next release. Re-verified against the tree rather than
assumed: no release-please-config.json, no .release-please-manifest.json, no commitlint
or .versionrc/.releaserc, and three workflows total — none of which publishes or bumps
anything. §3 now documents the real process: make version-set VERSION=x.y.z writes all
five declaration sites, the required version-consistency gate refuses a disagreement (or
a pyproject.toml that regrew a static version =), CHANGELOG.md is hand-written under
[Unreleased], and releases are hand-cut annotated tags with release-check as a
post-hoc detector, not a gate. Automation is named as a future item — not implied as
present, which is the distinction the STATUS row existed to protect.

§4's adapter cookbook predated the shipped contract (#30). It walked
build_command/parse_output for a wrapped external binary and opened with "copy the
template adapter" — a template that does not exist. Rewritten to the shipped probe()
contract across all three protocols, plus the two things a new adapter needs to actually be
scored: the fixture pair and the lab positive/clean pair. build_command is documented as
what it is — the subprocess path for copyleft tools (PX-LICENSE), exactly one of the two
live per adapter — rather than deleted.

Two things the old recipe never said and a contributor could not infer:
Evidence.matched_rule gets its own step because the accuracy harness keys on it and raises
without it, and the lab manifest's adapter: key silently defaults to security_headers
if omitted. The three hand-maintained wiring lists (compose services + depends_on, the
Makefile up -d list, a --adapter run line) are written down as the sharp edge they are:
nothing derives them from the entry points, so an adapter can ship, pass its unit tests, and
never be scored at all.

Honest about enforcement too — PX-ATTACK's technique ID is format-validated but its
presence is not, and cvss is optional on the model, so §4 says that is on the reviewer
instead of implying CI catches it.

Also corrected where the same falsehood had propagated.
docs/PROJECT_SETUP_PLAYBOOK.md §B1 and its §B2 flow diagram carried it verbatim, in the
file CONTRIBUTING links to as the workflow of record. packages/adapters/README.md — the
doc QUICKSTART points at as the accurate contract — was itself still calling the SDK
"scaffolding", documenting build_command as the contract, omitting ActiveApiAdapter
entirely, and pointing circularly back at the §4 it was supposed to be the authority for.

DoD gained two steps the project already required in practice but never wrote down:
updating docs/STATUS.md and adding a [Unreleased] changelog entry. Mirrored into the PR
template so the two cannot drift. This PR is the first to obey the changelog step.

No product code changed. No release automation was built.

Closes #34
Closes #30

Verification

Every command and path in the new text was executed or read out of the tree before being
written, not paraphrased from the docs it replaces:

• make version-set with no VERSION → usage: make version-set VERSION=x.y.z, exit 1.
• assert_version_consistency.py on the clean tree → 0.1.1 consistently across 5 sites.
• importlib.metadata.entry_points over all three groups → provx.adapters (5),
  provx.api_adapters (1), provx.active_api_adapters (3).
• make help for the lint / test / accuracy targets replacing §5's prose tool list.
• Every link target in the touched files resolves; the renamed §4 anchor was followed
  through in .github/ISSUE_TEMPLATE/new-adapter.yml and docs/QUICKSTART.md, which had
  said the recipe "predates the current contract".
• assert_workflow_gating.test.sh, assert_workflow_gating.py, and
  assert_version_consistency.test.sh all pass locally — this PR touches .github/**, so
  workflow-gate runs.

Definition of Done

• Safety — n/a, documentation only; no check, adapter, or egress path added.
• Signal quality — n/a, no findings emitted.
• Fixture test added — n/a, no adapter or parser changed.
• Accuracy gate passes — n/a, no check or lab target touched (gate skips: no
  backend/adapters/lab path in the diff).
• Docs / manifest updated — this PR is the doc update.
• Plan-of-record updated — docs/STATUS.md: both deferral rows resolved in place,
  plus a new row for the remaining known drift.
• Changelog — [Unreleased] entry added.
• Platform security — n/a, no secret or state-changing action involved.
• DCO — every commit signed off.

Safety classification

• passive (documentation only — no runtime behaviour changes)