[Amanbig]

Summary

Makes the repo look and work like a proper open-source project, and removes the README screenshots (they show the pre-redesign UI).

Added

• CONTRIBUTING.md: setup, workflow, what a good PR includes, where things live, how to add a provider / tool / slash command, testing notes (no real ~/.devorch, don't assert on --help text, the virtual-terminal harness, mock the model), and the maintainer release steps
• SECURITY.md: private reporting through GitHub security advisories, supported versions, and what actually counts as a vulnerability for an agent that runs commands by design (permission bypass, a cloned repo executing code without devorch trust, key leaks, injection through tool arguments)
• CODE_OF_CONDUCT.md: short, in plain words (inspired by the Contributor Covenant)
• Issue forms (bug report with version / provider / OS / terminal fields and a secrets reminder, feature request), a config linking to private vulnerability reporting, and a PR template with a checklist
• .github/dependabot.yml: monthly updates for pip and GitHub Actions (this will open PRs)

Changed

• README: removed the Screenshots section (the image files in assets/ are left in place, now unreferenced); the Contributing section points to the new guide plus Code of Conduct and Security; roadmap ticks streaming, image input and @file mentions as done. I did not add a CI status badge: CI runs on pull requests only now, so a main badge would show "no status"

For the maintainer

• Enable private vulnerability reporting in the repo (Settings -> Code security), otherwise the SECURITY.md link does not work
• The bug template asks for devorch --version, which arrives in a follow-up PR (it falls back to pip show devorch)
• Worth adding later: GitHub Discussions, repo topics and description, and a social-preview image

Checks

• All new YAML parses; issue forms have the required keys and unique field ids
• No code changes