v1.3 — Community standards, Playwright E2E, hierarchical ADR index

Theme: signal + governance. The project gains a **visible end-to-end
safety net** (Playwright golden-path suite, ADR-0033) that immediately
caught its first real bug (CORS `X-API-Version` allowlist miss), plus
a **community health layer** (SECURITY, CONTRIBUTING, issue/MR/PR
templates on both GitLab + GitHub, ADR-0032) and a **navigable ADR
index** (9 themes on top of the flat Nygard numbering).

Highlights
----------

UI (mirador-ui)
 * Playwright E2E — 3 golden-path specs (login, customer CRUD, health)
   running against a live backend; @demo spec drives a demo-GIF
   recorder (`bin/record-demo.sh`); @visual spec ships free-tier
   Playwright screenshot regression (replaces Chromatic per ADR-0021).
 * CI e2e:kind job added (allow_failure: true until 10 green runs).
 * Root hygiene — `commitlint.config.mjs` and `ROADMAP.md` moved out
   of repo root per the new "Root file hygiene" rule in CLAUDE.md.

Service (mirador-service)
 * ADR-0032 — community standards + hierarchical ADR index (9 themes).
 * ADR-0033 — Playwright E2E in kind-in-CI.
 * CORS fix — `X-API-Version` added to allowed headers (caught by
   Playwright E2E on first run).
 * CI hardening — openapi-lint unblocked (spectral rule drift),
   sbom:syft retry on Go/QEMU runtime flakes.
 * Root hygiene — `Dockerfile.native`, `docker-compose.*.yml`,
   `commitlint.config.mjs` relocated.

Documentation
 * Claude Opus 4.7 is now named concretely in the AI-assisted section
   of README / README.fr / CONTRIBUTING on both repos.
 * Security / contributing / issue / MR / PR templates committed to
   both GitLab + GitHub for the Community Standards checklist.

See [CHANGELOG.md] or GitLab release notes for the full diff.