chore: add agent governance and locked Trunk checks

[Claudio9701]

Summary

• add a locked Trunk 1.25 toolchain and a whole-repository Trunk Code Quality PR check
• keep direct uv commands documented as authoritative fallbacks
• add repository/Copilot instructions with explicit SonarQube, hermetic-test, Pydantic, Geofabrik, and OSRM boundaries
• define what coding agents may do and reserve merging, releases, secrets, branch policy, and finding dismissal for maintainers
• add CODEOWNERS, structured issue forms, a risk-aware PR template, and uv/GitHub Actions Dependabot updates
• replace stale contribution guidance with the actual uv/Trunk/stacked-PR workflow

Trunk scope

Trunk orchestrates small, deterministic linters and format checks. It is intentionally not the OSRM lifecycle implementation, and direct uv checks remain available. Security remains enforced by pip-audit, GitGuardian, SonarQube, SHA pinning, and later OSRM hardening rather than slow/duplicative local scanners.

Validation

• trunk check --all --ci --no-progress (100 files, clean)
• uv run pytest (12 pass, 2 explicitly deselected external tests)
• uv run ruff check urbanpy tests
• git diff --check

Stack

Base: #76 (ci/hermetic-pr-gates)
Roadmap: #61

Closes #77
Refs #65