chore: repository scaffolding

The org's standard furniture for a new repo: licence, code of conduct, security
policy, contributing guide, issue and pull-request templates, and the ignore
rules. No module yet — that arrives as the first pull request, so this branch
exists to open one against.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016wDDVXWMDz82WqE1i969r4

.gitignore

@@ -0,0 +1,36 @@
+# The template's own ignore rules, so they travel with a copy.
+#
+# The kit repo's root .gitignore covers these paths too, but that file stays
+# behind: copy `template/` out, `git init`, and you inherit nothing — `node_modules/`
+# included. Reported by the acceptance run (docs/modules/kit-acceptance.md, F6).
+
+# dependencies
+node_modules/
+
+# ── The built client chunk ────────────────────────────────────────────────
+#
+# Ignored HERE and shipped in the RELEASE, which is not a contradiction: a module
+# is installed prebuilt (an operator never builds anything), but the artifact is
+# built by CI from the source next to it, and a chunk committed by hand goes stale
+# beside fresh source without anything saying so.
+#
+# Your release workflow builds it before packing the bundle. If you would rather
+# commit it, delete this line and accept that you now have to remember.
+client/dist/
+
+# env / secrets — a module's env vars are the operator's, never the repo's
+.env
+*.env
+!.env.example
+
+# release staging, produced by .gitea/workflows/release.yml
+/dist/
+*.tar.gz
+
+# logs / os / editor
+*.log
+npm-debug.log*
+.DS_Store
+Thumbs.db
+.vscode/
+.idea/