Token-Permissions (0 -> 10): Set permissions: {} at workflow top level
across all 7 workflows, moved write scopes to per-job minimum.
SAST (0 -> 10): Added CodeQL workflow for JavaScript/TypeScript and
Python analysis on push, PR, and weekly schedule.
Vulnerabilities (0 -> ~8): Added 13 pnpm overrides to patch transitive
dependency vulnerabilities (38 -> 2 remaining, both in dev-only tools).
Pinned-Dependencies (5 -> 8-9): Pinned all Docker FROM images to SHA
digests, pinned pip-audit version in CI, pinned pip version in
Dockerfile.
- CODEOWNERS: use @snapotter-hq username instead of non-existent team
- PR template: use absolute URLs (relative links break in PR body)
- CLA: strengthen entity definition with successor/assignee clause
- CLA workflow: store signatures on dedicated branch, add owner to allowlist
- CONTRIBUTING: clarify approval means the "approved" label, reword CCLA
- Bug template: allow "running from source" for developer contributors
Add full contribution infrastructure: CLA with broad sublicensing
rights for dual-licensing, CONTRIBUTING.md with scope rules and dev
setup, CLA Assistant workflow, CODEOWNERS, SUPPORT.md, PR template,
updated issue templates with contribution prompts, and declarative
label config.
