chore: establish public launch governance - #14

Summary

Establishes the public governance and contribution surface required before
the QuantumD repository becomes public.

Adds:

• security reporting policy
• contribution policy
• support boundaries
• community conduct policy
• alpha evaluator guide
• structured bug, feature, and alpha-feedback issue forms
• pull-request trust-boundary checklist

Also upgrades official GitHub Actions to Node.js 24 capable major releases and
pins every reference to an immutable commit SHA.

Validation

• full pytest suite passed
• strict documentation build passed
• YAML validation passed
• public-alpha built-wheel acceptance passed
• unsigned governed execution failed closed
• local simulator quickstart passed
• independent evidence-chain verification passed
• repository remained clean after acceptance

Visibility

This pull request does not change repository visibility or GitHub settings.
The repository remains private until the remaining public-launch gates pass.