E3: add community health files

The repository had no contributor-facing documentation or automation
config. Add the standard set:

- CHANGELOG.md (Keep a Changelog format, 0.1.0-0.1.4 plus Unreleased)
- CONTRIBUTING.md (build/test steps, change standards, PolyForm-NC note)
- SECURITY.md (private reporting, supported versions)
- CODE_OF_CONDUCT.md (Contributor Covenant 2.1)
- .github/ISSUE_TEMPLATE (bug report, feature request, config)
- .github/PULL_REQUEST_TEMPLATE.md
- .github/dependabot.yml (cargo, npm, pip, github-actions — the last
  keeps the D1 SHA pins current)
- .github/CODEOWNERS

SECURITY.md

@@ -0,0 +1,43 @@
+# Security Policy
+
+## Supported versions
+
+Wickra is pre-1.0. Security fixes are applied to the latest released `0.1.x`
+version only; please upgrade to the newest release before reporting an issue.
+
+| Version | Supported |
+| --- | --- |
+| 0.1.x (latest) | :white_check_mark: |
+| older 0.1.x | :x: |
+
+## Reporting a vulnerability
+
+**Do not open a public issue for a security vulnerability.**
+
+Report it privately through one of:
+
+- GitHub's [private vulnerability reporting](https://github.com/kingchenc/wickra/security/advisories/new)
+  ("Report a vulnerability" under the repository's *Security* tab), or
+- email to **kingchencp@gmail.com** with a subject line starting with
+  `[wickra security]`.
+
+Please include:
+
+- the affected version(s) and platform / language binding,
+- a description of the issue and its impact,
+- steps to reproduce, ideally a minimal proof of concept.
+
+## What to expect
+
+- An acknowledgement within **5 working days**.
+- An assessment and, if confirmed, a planned fix with a target release.
+- Coordinated disclosure: we will agree on a disclosure date with you and
+  credit you in the release notes unless you prefer to stay anonymous.
+
+## Scope
+
+In scope: the published crates (`wickra-core`, `wickra-data`, `wickra`), the
+PyPI/npm packages, and the build/release workflows in `.github/workflows/`.
+
+Out of scope: vulnerabilities in third-party dependencies (report those
+upstream; we track them via Dependabot and `cargo-deny`).