E3: add community health files

The repository had no contributor-facing documentation or automation
config. Add the standard set:

- CHANGELOG.md (Keep a Changelog format, 0.1.0-0.1.4 plus Unreleased)
- CONTRIBUTING.md (build/test steps, change standards, PolyForm-NC note)
- SECURITY.md (private reporting, supported versions)
- CODE_OF_CONDUCT.md (Contributor Covenant 2.1)
- .github/ISSUE_TEMPLATE (bug report, feature request, config)
- .github/PULL_REQUEST_TEMPLATE.md
- .github/dependabot.yml (cargo, npm, pip, github-actions — the last
  keeps the D1 SHA pins current)
- .github/CODEOWNERS

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,33 @@
+<!-- Thanks for contributing to Wickra. Please fill in the sections below. -->
+
+## Summary
+
+<!-- What does this PR change, and why? -->
+
+## Related issue
+
+<!-- e.g. Closes #123 -->
+
+## Type of change
+
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Indicator addition / change
+- [ ] Documentation
+- [ ] CI / build / tooling
+
+## Checklist
+
+- [ ] `cargo fmt --all --check` is clean.
+- [ ] `cargo clippy --workspace --all-targets -- -D warnings` is clean.
+- [ ] `cargo test --workspace` passes.
+- [ ] New behaviour has tests; bug fixes have a regression test.
+- [ ] Public API changes are mirrored in the Python / Node / WASM bindings
+      and their type stubs (if applicable).
+- [ ] Documentation under `docs/wiki/` and the `README.md` is updated
+      (if applicable).
+- [ ] An entry was added under `## [Unreleased]` in `CHANGELOG.md`.
+
+## Notes for reviewers
+
+<!-- Anything that needs extra attention, trade-offs, follow-ups. -->