P2: establish enterprise OSS governance baseline

[tuzuminami]

Closes #15

Change

Adds the enterprise OSS governance baseline: ownership, contribution templates, release policy, and public-boundary guidance.

Tracking

• Issue or requirement ID: P2: establish enterprise OSS ownership, contribution templates, and release protections #15
• Release or deployment impact: GitHub repository configuration only; no package API or database migration.

Compatibility

• No public API, contract, package, or migration impact.
• A compatible additive change.
• A breaking change with an approved migration and release note.

Safety and Operations

• Tenant, authorization, idempotency, and audit behavior were considered where relevant.
• No secrets, production data, private prompts, or local-only material are included.
• Observability, rollback, and operational impact are documented or not applicable.

Evidence

• Tests or other reproducible verification were added or updated.
• pnpm run verify passed locally.
• Documentation and OpenAPI/JSON Schema artifacts remain aligned, when applicable.

Solo Maintainer Review Record

• Decision rationale: use an active ruleset instead of incompatible classic branch restrictions for a personal repository.
• Principal risks considered: self-approval lockout, stale CI, mutable release tags, and no private vulnerability path.
• Rollback or containment plan: rulesets have no normal bypass; an audited owner-only incident bypass must be followed by a PR restoring the protected state.
• Known follow-up or residual risk: PostgreSQL integration needs a database service in CI/local verification; the package and compiled test gates passed.

GitHub configuration applied: private vulnerability reporting enabled; main-pr-ci and release-tags rulesets active.