chore(community): add contributing infra, issue/PR templates, npm publish workflow

Tier A infrastructure to convert 204★ momentum into durable community and
distribution. Pairs with PR #12 (ETHICS / CHANGELOG / fidelity smoke) — merge
PR #12 first, then this.

**Community docs**
- `CONTRIBUTING.md` — three-tier contribution flow (code vs docs vs master
  content), with a detailed §3 "how to contribute a new master" covering
  copyright tier self-check, `/create-master` vs manual path, SKILL.md
  frontmatter spec, voice.md Layer 0-3, fidelity.jsonl authoring.
- `CODE_OF_CONDUCT.md` — Contributor Covenant 2.1 + Buddhist-project-specific
  rules (no doctrinal supremacy, no using the repo as a dharma platform, no
  impersonating clergy, no apocryphal scripture citations).
- `SECURITY.md` — threat model (prompt injection, supply chain, secret leak,
  installer safety, religious-boundary adversarial input), SLA table, GH
  Security Advisory as primary channel.

**Issue / PR templates**
- `bug_report.yml` — area selector, master selector, repro template.
- `feature_request.yml` — non-master enhancement requests.
- `new_master.yml` — **MUST precede any new-master PR**; forces tier A/B/D
  self-judgment and citation planning before sunk cost.
- `boundary_violation.yml` — P0 template for ETHICS.md §3 violations.
- `config.yml` — directs users to Discussions for chatter, Security Advisory
  for vulnerabilities, email for urgent takedowns.
- `PULL_REQUEST_TEMPLATE.md` — change-type checkboxes, self-check list, new-
  master fields, local-test block.

**npm publish**
- `.github/workflows/npm-publish.yml` — release-tag + workflow_dispatch, with
  dry-run mode, tag-version match check, `npm publish --provenance`.
  First-time publish needs NPM_TOKEN secret (user action).
- `package.json` hardening:
  - `engines.node: >=18`
  - scripts: `validate`, `validate:fidelity`, `test`, `test:smoke`, `prepack`
  - `publishConfig` (public, npm registry)
  - `files` list expanded to include platform manifests + governance docs
  - richer `keywords`, `author`, `bugs`, `homepage` fields
  - expanded description mentions all 8 masters for search discoverability

**README**
- 贡献指南 section rewritten to point at CONTRIBUTING.md + Discussions +
  four issue templates, with "先开 New Master issue 征询" gate spelled out.

Discussions were enabled on the repo alongside this commit via `gh api`, so
the links in README/templates resolve immediately on merge.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/ISSUE_TEMPLATE/new_master.yml

@@ -0,0 +1,115 @@
+name: 🧘 新法师提议
+description: 提议收录一位新的祖师大德（⚠️ 提 PR 前请先开此 issue 征询，避免已完成工作被拒）
+title: "[New Master] "
+labels: ["new-master", "needs-tier-check"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        ## ⚠️ 重要：提 PR 前必须先开此 issue
+
+        贡献一位新法师涉及**版权判定、教界边界、史料可得性**三层审查。已完成 `prebuilt/` 目录再被拒的成本很高，因此请先在这里征询意见。
+
+        **必读**：[`ETHICS.md`](https://github.com/xr843/Master-skill/blob/main/ETHICS.md) §2（版权 Tier）、§3（教界边界），以及 [`CONTRIBUTING.md`](https://github.com/xr843/Master-skill/blob/main/CONTRIBUTING.md) §3。
+
+  - type: input
+    id: master-name
+    attributes:
+      label: 法师名称
+      placeholder: "例如：马祖道一 / 临济义玄 / 弘一大师"
+    validations:
+      required: true
+
+  - type: input
+    id: slug
+    attributes:
+      label: 建议 slug（小写英文或拼音）
+      placeholder: "例如：mazu / linji / hongyi"
+    validations:
+      required: true
+
+  - type: input
+    id: dates
+    attributes:
+      label: 生卒年
+      placeholder: "例如：709-788 / 1880-1942"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: lineage
+    attributes:
+      label: 主要宗派 / 传承
+      options:
+        - 禅宗
+        - 净土宗
+        - 天台宗
+        - 华严宗
+        - 法相唯识宗
+        - 三论宗（中观）
+        - 律宗
+        - 密宗 / 真言宗
+        - 跨宗派融合
+        - 其它
+    validations:
+      required: true
+
+  - type: dropdown
+    id: tier
+    attributes:
+      label: 版权 Tier 自评（参考 ETHICS.md §2）
+      options:
+        - "Tier A — 公有领域（圆寂 > 50 年，中国大陆 / 台湾）"
+        - "Tier A — 公有领域（圆寂 > 70 年，大多数其它辖区）"
+        - "Tier B — 仍在版权期（需附授权证明）"
+        - "Tier D — 灰色，需讨论"
+        - "不确定"
+    validations:
+      required: true
+
+  - type: textarea
+    id: tier-justification
+    attributes:
+      label: Tier 判定理由
+      description: 引用具体的圆寂年份、授权文件、学界共识等。Tier B 必须附授权证明链接。
+      placeholder: "例如：印光大师圆寂 1940 年，距今 85 年；中国大陆著作权保护期 50 年，已于 1990 年过期。文钞 CBETA X62n1182, X62n1183 已收录公有学术版本。"
+    validations:
+      required: true
+
+  - type: textarea
+    id: sources
+    attributes:
+      label: 主要 CBETA / FoJin 数据源
+      description: 至少 3 部代表性经论或文集的 CBETA ID + 可选 FoJin text_id
+      placeholder: |
+        - 《六祖坛经》T48n2008
+        - 《景德传灯录》T51n2076 慧能章
+        - FoJin text_id: 待查
+    validations:
+      required: true
+
+  - type: textarea
+    id: why-now
+    attributes:
+      label: 为什么收录这位法师？
+      description: 从用户需求 / 宗派覆盖 / 对比价值 / 数据可得性角度说明
+      placeholder: "例如：当前 8 位覆盖唯识/中观/禅/天台/华严/净土/跨宗派，但禅宗各家（马祖/临济/赵州）未单独立传。马祖作为洪州宗代表，与慧能的南宗直指、虚云的近代参禅形成三代对比，/compare-masters 价值显著。"
+    validations:
+      required: true
+
+  - type: textarea
+    id: ethical-concerns
+    attributes:
+      label: 可能的教界边界 / 学界争议
+      description: 有无学派争议、身份考证分歧、特定地区的敏感性？
+      placeholder: "例如：《坛经》版本差异（敦煌本 vs 宗宝本），现当代学界倾向敦煌本为近祖；神会造论说需要说明但不过度卷入。"
+    validations:
+      required: false
+
+  - type: textarea
+    id: volunteer
+    attributes:
+      label: 是否愿意亲自贡献 PR？
+      placeholder: "是 / 否。如是，预计何时可提？"
+    validations:
+      required: true