chore: org hardening — SHA-pinned actions, governance docs, Scorecard, issue forms

[FumingPower3925]

File-based part of the org hardening review 2026-09-06 for goceleris/celeris. GitHub settings/rulesets and the bench cluster are handled separately; this PR only touches files. Workflow semantics are unchanged except where listed.

Changes and rationale

Supply chain / workflows

Change	Why
SHA-pin every third-party action in ci.yml, drivers.yml, release.yml (+ the new scorecard.yml): actions/checkout@3d3c42e5… # v7.0.1, actions/setup-go@b7ad1dad… # v7.0.0, golangci/golangci-lint-action@ba0d7d2e… # v9.3.0, ossf/scorecard-action@2d114668… # v2.4.4, github/codeql-action/upload-sarif@cdf488f5… # v4.37.9. SHAs resolved from the current tags via the GitHub API (annotated tags dereferenced to the commit).	A floating tag can be moved by anyone with push access to the action repo; a SHA cannot. The trailing version comment lets dependabot's github-actions ecosystem (already configured) keep the SHAs current.
persist-credentials: false on every actions/checkout step in jobs that never push (all of ci.yml, drivers.yml, and notify-proxy in release.yml). tag-submodules keeps the default because it pushes tags (explicit zizmor: ignore[artipacked] with the reason).	The job token otherwise stays in .git/config for every later step and any compromised dependency to read.
Pin tool installs: mage@v1.17.2, actionlint@v1.7.12 (were @latest). govulncheck stays @latest.	A new upstream release can no longer turn main red by itself. govulncheck's DB is fetched at runtime, so its binary version is not the freshness that matters.
zizmor step next to actionlint: pipx run --spec zizmor==1.30.0 zizmor .github/workflows with GH_TOKEN: ${{ github.token }} (ephemeral read-only job token, no repository secrets).	actionlint checks syntax; zizmor checks security posture (unpinned actions, persisted credentials, template injection, excessive permissions). Passes with 0 findings on this branch (2 explicit, commented ignores).
release.yml least privilege: top-level contents: read; contents: write only on tag-submodules.	Only the tag-push job needs write; the proxy-notify and validate jobs no longer can push. Caller permissions still cover the reusable ci.yml (contents: read).
release.yml template injection: ${{ github.event.release.tag_name }} moved from six run: bodies into step env: and read as $TAG / $VERSION.	Identical behaviour for every valid tag; a crafted tag name can no longer expand into shell code. Required for the zizmor step to pass.
release.yml notify-proxy setup-go cache: false.	The job only runs go list -m against the proxy; a module cache restored into a release-triggered job is a cache-poisoning vector.
New scorecard.yml (OpenSSF Scorecard): triggers branch_protection_rule, weekly schedule, push to main; permissions: read-all at top, job security-events: write + id-token: write; checkout without credentials; publish_results: true; SARIF upload via SHA-pinned codeql-action/upload-sarif.	Continuous, public measurement of the posture this review hardens.

Note: the reusable-workflow call stays uses: ./.github/workflows/ci.yml — actionlint 1.7.12 does not yet accept GitHub's newer $/ self-repository form, so it carries a commented zizmor: ignore[self-repository].

Governance and process

Change	Why
GOVERNANCE.md (one page): roles Contributor → contributors team member (write on celeris only; may approve; may merge own PRs only after a code-owner approval and green required checks; ~3 merged non-trivial PRs + sustained engagement) → Maintainer (admin; cuts releases; owns CODEOWNERS; currently @FumingPower3925). Merge rule: required checks green + code-owner approval; author with write or approving maintainer (auto-merge) merges; nobody merges their own PR without a code-owner approval; admin bypass reserved for release/infra emergencies and visible in the audit log. Decisions: single maintainer today; lazy consensus (72 h) once there is more than one. Releases: tagged after the probatorium nightly + weekend soak pass; notes from PR labels + hand-written highlights; GitHub Releases is the changelog (no CHANGELOG.md).	Writes down how the project is actually run so the rules that the rulesets enforce are also legible to humans.
MAINTAINERS.md: maintainer table (@FumingPower3925, areas: all) and the contributors team (@WdnLiu), with how to become one (links GOVERNANCE.md).	Names are otherwise only visible in org settings.
.github/CODEOWNERS: header, * @FumingPower3925, commented area-delegation example (# /middleware/ @FumingPower3925 @WdnLiu).	Gives the "code-owner approval" ruleset something to resolve against.
CONTRIBUTING.md: new "How changes get merged", "Labels and release notes" (bug / enhancement / performance / security / breaking / dependencies; no CHANGELOG.md), "Commit sign-off" (git commit -s, DCO recommended, not mandatory yet); links GOVERNANCE.md and MAINTAINERS.md; security paragraph points at private reporting. Everything else kept.	Mirrors the governance rule where contributors actually read.
SECURITY.md: private vulnerability reporting (Security tab → "Report a vulnerability", https://github.com/goceleris/celeris/security/advisories/new) is now the preferred channel, above security@goceleris.dev; acknowledgement within 72 hours. Supported-versions table and release notes kept.	Private reporting is enabled on the repo; 72 h is what a single-maintainer project can actually promise.
.github/release.yml: changelog.exclude labels dependencies, github_actions; categories Breaking changes [breaking], Security [security], Fixes [bug], Performance [performance], Features [enhancement], Other [*].	Makes the generated release notes the changelog.
Issue forms replace the markdown templates: bug_report.yml (Engine dropdown std/epoll/io_uring/adaptive required, Architecture dropdown amd64/arm64/other required, celeris version required, OS/kernel, Minimal reproduction render: go required, Expected vs actual; labels bug, needs-triage), feature_request.yml (problem / proposal / alternatives; labels enhancement, needs-triage), config.yml (blank_issues_enabled: false, contact link "Security vulnerability" → private advisory form). bug_report.md and feature_request.md deleted.	Engine and architecture decide whether an engine bug can be reproduced at all; blank issues and public security reports are closed off.
PR template: adds Closes #, Tested on: [ ] std [ ] epoll [ ] io_uring — [ ] amd64 [ ] arm64, [ ] Breaking change? (label breaking), [ ] Labeled for release notes.	Matches the label-driven release notes and the engine matrix.

Verification

• actionlint (v1.7.12, local): clean on all four workflows.
• zizmor 1.30.0 with online audits (GH_TOKEN set, as CI will run it): No findings (2 ignored with reasons, 16 suppressed).
• python3 -c 'import yaml' parse of every .github/**/*.yml: OK (workflows, issue forms, release.yml, dependabot.yml).
• grep -rnE 'uses: [^./][^@]*@v' .github/ → nothing (no unpinned third-party references remain; the only non-SHA uses: is the in-repo ./.github/workflows/ci.yml).
• No Go code changed, so no go build / go vet was needed.

Not in this PR

Rulesets / branch protection, required checks, the contributors team scope, private-vulnerability-reporting toggle and the bench cluster are configured separately as part of the same review. Labels referenced by .github/release.yml and the issue forms (performance, security, breaking, needs-triage) must exist in the repository for the sections/forms to apply them.