chore: establish open-source repository baseline

[sjungwon03]

Summary

Establishes the executable open-source baseline required before enabling PlanGuard's Theorvane dev integration and release-only main governance.

Changes

• Add MIT license, contribution, security, support, Code of Conduct, and governance documentation.
• Add CODEOWNERS and weekly Dependabot checks for npm and GitHub Actions.
• Add a least-privilege Node 22 CI workflow that runs PlanGuard's actual typecheck, test, and harness commands on dev and main pull requests/pushes.
• Add a release-promotion gate that accepts only repository-owned dev → main pull requests.
• Link contributor resources from the public README.

Validation

• YAML syntax and workflow contracts validated locally.
• Markdown repository-relative links validated.
• npm ci
• npm run typecheck
• npm run test
• npm run harness
• git diff --check

Security boundary

No deterministic risk/policy/cost code or Action implementation changed. The AI/Terraform two-job isolation contract remains intact.

Closes #56