chore: professionalize repository governance and presentation

[CognitiveCodeAI]

Summary

Professionalize NPR-RAG's public GitHub presence and repository governance using CognitiveCodeAI/lazarus as the proven reference.

GitHub's community profile currently scores NPR-RAG at 71% versus Lazarus at 100%. This change closes the file-based gaps and strengthens the actual CI and contributor workflow without changing application behavior.

Repository presentation

• rebuilds the README front page with project identity, CI/runtime/status badges, direct navigation, a product view, the real clone URL, and an explicit controlled-pilot status
• corrects the documented Python, Node, Next.js, React, and answer-generation stack
• adds clear support, security, contributing, maintaining, and release paths
• keeps production-readiness claims aligned with verified evidence

Community and governance

• adds a Contributor Covenant-based Code of Conduct
• adds structured bug and feature issue forms with sensitive-data warnings
• adds a pull-request template with risk, rollback, migration, ACL, provenance, citation, and highlighting checks
• adds CODEOWNERS for automatic review routing
• adds support, maintainer, and release guides
• expands contributing, security, changelog, and release-checklist documentation
• adds EditorConfig and ignores local browser, evaluation, and research artifacts

CI quality

• adds manual workflow dispatch
• cancels superseded runs on the same ref
• adds bounded job timeouts
• fixes the existing shellcheck warning in database initialization

Live GitHub settings already applied

The following reversible repository settings were verified through the GitHub API:

• professional description, Cognitive Code homepage, and focused project topics
• Discussions enabled
• merged branches automatically deleted
• secret scanning enabled
• secret-scanning push protection enabled
• Dependabot vulnerability alerts and security updates enabled
• private vulnerability reporting enabled
• active protect-main ruleset preventing default-branch deletion and force pushes

Projects and the repository name were intentionally left unchanged. Renaming rag-main-2 affects public URLs and integrations and should be a separate owner decision.

Validation

• actionlint .github/workflows/ci.yml: passed
• all five repository YAML files parsed successfully
• all relative links in the updated root documentation resolve
• staged whitespace check: passed
• staged secret-pattern scan: no matches
• GitHub settings and security controls re-read and verified active

Scope

This branch was created directly from origin/main. It is independent of the evidence-chain/highlighting work in PR #72 and contains no application-runtime changes.

Review guide

Start with:

• README.md
• .github/PULL_REQUEST_TEMPLATE.md
• .github/ISSUE_TEMPLATE/
• MAINTAINING.md
• RELEASING.md
• SECURITY.md
• .github/workflows/ci.yml