Complete GitHub's community health checklist except the code of conduct: CONTRIBUTING.md, SECURITY.md with private vulnerability reporting, and issue forms that route CLI and security reports away from public widget issues. The security policy keeps the widget's own secret prompt and stdin handoff in scope. README, docs index, development guide, changelog, and the editorial CI allowlist are updated with it.