chore: close conformity gaps against public-sector/reference

Adds AGENTS.md, the CLAUDE.md shim, CONTRIBUTING.md, CHANGELOG.md (stubs transcribed from the real annotated tags), CODE_OF_CONDUCT.md, and .reference.yaml. SECURITY.md gains a "Reporting a vulnerability" section (confidential-issue route, maintainer backup, response timelines, CVSS-based severity statement) added to, not replacing, the security assessment the catalog compliance component requires.

Content stamped from gitlab-com/public-sector/reference templates, adapted to what is true of this repo. Remaining audit failure after this: osv-verdict adoption, tracked separately.