Prepare public contribution and security reporting guidance

[thisisjun786]

Change

Prepare the Apache-2.0 Codex-only source for public contributions. Replace temporary publication-preparation notices with durable source, license and validation guidance; document the enforced development gate and future release gate; link private vulnerability reporting and add a contributor entry point.

Verification

• Local contribution-file validation, changed-document link checks and git diff --check passed.
• CI on this PR runs the CI controls, complete-history secret scan, dependency audit, lint, type checks, package tests and runtime build against the combined merge candidate.

Risks and remaining work

Public visibility and private-reporting activation are verified as repository settings after this gated merge. This change does not create main, promote a release, publish packages or deploy services. Source checks do not qualify live provider behavior.