docs: repository governance, license, and backlog↔issue sync

[yashranaway]

Brings the repository up to the standard the product itself claims. No shipped behaviour changes.

Legal — the one that actually mattered

The repository was public with no LICENSE file. It is a fork of antiwork/chromeless, which is MIT, so two things were wrong: redistribution rights here were undefined, and the upstream copyright notice was not being carried as MIT requires. Added LICENSE (MIT) preserving Copyright (c) 2026 Antiwork, Inc. alongside the LockInTime notice.

If the intended license is anything other than MIT, say so — but note the upstream notice has to stay regardless.

Governance

File	Why
SECURITY.md	Private reporting route, plus the boundary table a report is judged against (no arbitrary execution, navigation, downloads, control plane, artifacts, secrets, untrusted content, sandbox) and the limitations that are not vulnerabilities
CONTRIBUTING.md	Setup per platform, the bar for a PR, style, and the rule that contract changes need an architecture-decision entry first
CODE_OF_CONDUCT.md	Contributor Covenant 2.1; enforcement routed through private advisories
CHANGELOG.md	Keep a Changelog format, with an Unreleased section — context pruning, capture formats, docs, and CI have all landed since v1.0.2

Tracker plumbing

• Issue forms for bugs and feature proposals. The feature form states the permanent non-goals up front (arbitrary JS, TCP listener, downloads, desktop automation) so those proposals do not get written in the first place.
• config.yml routes security reports to private advisories rather than public issues.
• PR template whose checklist is the host-enforced contract list.
• CODEOWNERS on the security-critical sources (Protocol, Transport, Artifacts, AgentRuntime, both hosts) and the roadmap docs.
• Dependabot for the web app (grouped react/next/tailwind/types), root tooling, Actions, and the Linux image. The Swift package is deliberately excluded — zero third-party dependencies is a documented feature.

Backlog ↔ issues

All 42 open backlog items are now GitHub issues (#12–#53), plus a tracking issue for the ten §G ideas (#54). Each issue body is extracted from the backlog text itself, so the two cannot drift, and each carries type/area/priority labels and the milestone for its roadmap phase. This PR adds the reverse links inline in the backlog file, and explains the workflow in AGENTS.md and README.md.

Correction included: §F1 claimed no deploy pipeline exists. It does — the site is live at headless-web-pi.vercel.app via Vercel's GitHub integration. Rewrote the item to describe what is actually missing: repo-visible config, deploy docs, and a real domain.

Also configured outside this PR

Labels (type/area/priority/status taxonomy), six milestones matching the roadmap phases, repo description and topics, delete_branch_on_merge, and branch protection on main requiring the six CI checks plus one review.

A GitHub project board could not be created — the CLI token lacks the project scope. Milestones cover the same ground; add the board manually if you want a kanban view.