feat(issues): org-wide issue forms with triage automation (issue-template-kit v1.0.0)

[cryptoxdog]

Problem

Org issue intake relies on four legacy markdown-era forms (bug_report, feature_request, ci-failure, gov-violation) with no required-field enforcement, no severity→priority derivation, no secret-leak scanning, and no stale-issue handling. Sister pack to #15 (PR templates), closing the intake side of the loop.

Fix

Deploys issue-template-kit v1.0.0 (all 14 files sha256-verified against MANIFEST.json):

• .github/ISSUE_TEMPLATE/config.yml — blank issues off; security reports → private advisory, questions → org Discussions, docs → CANONICAL_LAW.md (YOUR_ORG placeholders replaced with Quantum-L9 URLs)
• .github/ISSUE_TEMPLATE/1-bug.yml (10 fields, 7 required), 2-feature.yml (8/7), 3-task.yml (5/4), 4-incident.yml (9/7) — issue forms with validations.required, cannot be submitted empty
• .github/ISSUE_TEMPLATE/EXAMPLE.md — worked bug report standard, mirrors PULL_REQUEST_TEMPLATE/EXAMPLE.md
• .github/labels.yml — 25-label taxonomy; every label the workflows write is declared (zero undeclared)
• .github/workflows/issue-triage.yml — parses rendered headings, derives priority:* from Severity, sets regression/env:prod/area:ci routing, nudges (not gates) on missing evidence; single hard failure is the secret scan (ghp_/AKIA/sk-/PEM/JWT) → security:possible-leak + rotate caution
• .github/workflows/stale.yml — needs:info issues only, never PRs
• docs/issue-templates/{DEPLOY,DESIGN}.md — scoped directory to avoid colliding with the PR-kit docs in feat(pr): org-wide PR template kit v1.0.0 with intent reconciliation and gates #15
• scripts/sync-labels.sh — label sync utility

Note: legacy templates

The four legacy forms are kept alongside the kit forms (numbered kit forms sort first in the chooser). blank_issues_enabled: false now applies. Recommend a follow-up to either retire the legacy forms or fold gov-violation/ci-failure into the numbered scheme (e.g., 5-gov-violation.yml) so the chooser stays coherent.

Risk

• Low — forms only affect new issues; workflows are inert for other repos until distributed.
• A repo with even one local form ignores all org defaults (no merging) — repos with their own ISSUE_TEMPLATE keep current behavior.
• Merge-order note vs feat(pr): org-wide PR template kit v1.0.0 with intent reconciliation and gates #15: both branches add files under .github/workflows/; no filename overlap, so merges are conflict-free in either order.

Evidence

• 14/14 kit files verified against MANIFEST.json sha256 + byte counts before install.
• All forms + workflows parse as valid YAML; remote copies re-verified byte-identical (issue-triage 291a9db1…, stale b53ec950…, labels 3c39d3ca…).
• config.yml placeholder substitution verified: 0 remaining YOUR_ORG occurrences; Discussions URL returns 200.

Rollout (from docs/issue-templates/DEPLOY.md)

1. Merge — forms take effect for new issues in repos without local ISSUE_TEMPLATE overrides.
2. Run scripts/sync-labels.sh Quantum-L9/<repo> per repo so addLabels never creates random-colored labels.
3. Distribute the two workflows via workflow_call callers pinned @v1 (same pattern as feat(pr): org-wide PR template kit v1.0.0 with intent reconciliation and gates #15).
4. Validate: file a test bug with the form untouched — required fields block submission; then a filled one — triage should derive priority:* from Severity.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud