chore(community): add contributing infra, issue/PR templates, npm publish workflow

Tier A infrastructure to convert 204★ momentum into durable community and
distribution. Pairs with PR #12 (ETHICS / CHANGELOG / fidelity smoke) — merge
PR #12 first, then this.

**Community docs**
- `CONTRIBUTING.md` — three-tier contribution flow (code vs docs vs master
  content), with a detailed §3 "how to contribute a new master" covering
  copyright tier self-check, `/create-master` vs manual path, SKILL.md
  frontmatter spec, voice.md Layer 0-3, fidelity.jsonl authoring.
- `CODE_OF_CONDUCT.md` — Contributor Covenant 2.1 + Buddhist-project-specific
  rules (no doctrinal supremacy, no using the repo as a dharma platform, no
  impersonating clergy, no apocryphal scripture citations).
- `SECURITY.md` — threat model (prompt injection, supply chain, secret leak,
  installer safety, religious-boundary adversarial input), SLA table, GH
  Security Advisory as primary channel.

**Issue / PR templates**
- `bug_report.yml` — area selector, master selector, repro template.
- `feature_request.yml` — non-master enhancement requests.
- `new_master.yml` — **MUST precede any new-master PR**; forces tier A/B/D
  self-judgment and citation planning before sunk cost.
- `boundary_violation.yml` — P0 template for ETHICS.md §3 violations.
- `config.yml` — directs users to Discussions for chatter, Security Advisory
  for vulnerabilities, email for urgent takedowns.
- `PULL_REQUEST_TEMPLATE.md` — change-type checkboxes, self-check list, new-
  master fields, local-test block.

**npm publish**
- `.github/workflows/npm-publish.yml` — release-tag + workflow_dispatch, with
  dry-run mode, tag-version match check, `npm publish --provenance`.
  First-time publish needs NPM_TOKEN secret (user action).
- `package.json` hardening:
  - `engines.node: >=18`
  - scripts: `validate`, `validate:fidelity`, `test`, `test:smoke`, `prepack`
  - `publishConfig` (public, npm registry)
  - `files` list expanded to include platform manifests + governance docs
  - richer `keywords`, `author`, `bugs`, `homepage` fields
  - expanded description mentions all 8 masters for search discoverability

**README**
- 贡献指南 section rewritten to point at CONTRIBUTING.md + Discussions +
  four issue templates, with "先开 New Master issue 征询" gate spelled out.

Discussions were enabled on the repo alongside this commit via `gh api`, so
the links in README/templates resolve immediately on merge.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,94 @@
+name: 🐞 Bug Report
+description: 报告技术问题（CI 失败、脚本崩溃、installer 报错、错误引经、法师回答偏离预期等）
+title: "[Bug] "
+labels: ["bug", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        **先确认：**
+        - [ ] 已看过 [README](https://github.com/xr843/Master-skill#readme) 与 [CONTRIBUTING.md](https://github.com/xr843/Master-skill/blob/main/CONTRIBUTING.md)
+        - [ ] 已搜索现有 [issues](https://github.com/xr843/Master-skill/issues?q=is%3Aissue) 无重复
+        - [ ] 如果是**教界边界问题**（AI 给你传戒 / 印证开悟 / 灵媒化回答），请改用 [Boundary Violation 模板](./new?template=boundary_violation.yml)
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: 影响范围
+      options:
+        - CI / Workflow
+        - scripts/ (validate / fidelity / cite / query)
+        - bin/cli.mjs (NPX installer)
+        - tools/ (fojin_bridge / verify_sources / cross_reference)
+        - prebuilt/<master> 回答质量
+        - prebuilt/<master> 引经错误
+        - /create-master 生成管线
+        - /compare-masters 对比
+        - hooks (Claude Code / Cursor / Codex / OpenCode / Gemini)
+        - 文档 / README
+        - 其它
+    validations:
+      required: true
+
+  - type: input
+    id: master
+    attributes:
+      label: 涉及法师（如有）
+      placeholder: yinguang / xuanzang / ... 或 N/A
+    validations:
+      required: false
+
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: 发生了什么
+      description: 简要描述问题现象
+      placeholder: "例如「跑 `python scripts/validate.py --strict` 报 KeyError: 'sources'」"
+    validations:
+      required: true
+
+  - type: textarea
+    id: repro
+    attributes:
+      label: 复现步骤
+      description: 最小复现。越可复现越快修。
+      placeholder: |
+        1. `git clone https://github.com/xr843/Master-skill`
+        2. `pip install -r requirements.txt`
+        3. `python scripts/test-fidelity.py --master huineng --max-tests 1`
+        4. 看到 ...
+      render: bash
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: 预期行为
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: 日志 / 堆栈
+      description: 粘贴完整 traceback 或相关 log。**请删除 API key！**
+      render: shell
+    validations:
+      required: false
+
+  - type: input
+    id: platform
+    attributes:
+      label: 运行环境
+      placeholder: "macOS 14.4 / Python 3.11 / Node 20 / Claude Code 1.0.x"
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: Master-skill 版本或 commit SHA
+      placeholder: "v0.3.0 / main@abc1234"
+    validations:
+      required: true