Org templates, governance, and reusable lint workflow

[mshafiee]

Scope

Cross-cutting governance + tooling in the org .github repo. These become org-wide defaults for every repo that doesn't override them.

Changes

• Issue templates: bug_report.yml, feature_request.yml (bilingual fa/en note), config.yml (blank issues disabled; contact links to website, spec docs, security policy).
• PULL_REQUEST_TEMPLATE.md — spec-alignment + hard-constraint reminders (Debian 13 amd64-only, Plasma 6.7 Wayland-default, non-free on, Vazirmatn, ISIRI 9147 + ZWNJ, Asia/Tehran + Jalali) + bilingual note.
• CONTRIBUTING.md — spec map, repo map, branch model (trunk-based), conventions (shell/TS/bilingual UX), and the lint opt-in pattern.
• CODE_OF_CONDUCT.md — Contributor Covenant 2.1 (enforcement: conduct@zurvanlinux.org).
• SECURITY.md — private reporting (GitHub Private Vuln Reporting or encrypted email), response targets, scope, signing-key integrity + rotation pointer.
• .github/workflows/lint.yml — reusable (workflow_call): shellcheck + yamllint (tolerant config tuned for Actions YAML: line-length/indentation/comments off, truthy: {check-keys: false} for the on: key) + a conditional astro check/build job that only fires when an astro.config.* is present.
• profile/README.md — Status section updated from 'specification only' to Phase 1 in progress (reflects M1.1a/M1.2/M1.3 landing + the pending P0).
• README.md — documents the org-level files + the lint opt-in snippet.

Opt-in pattern (other repos)

# .github/workflows/lint.yml
name: Lint
on: { push: { branches: [main] }, pull_request: {} }
jobs:
  lint:
    uses: ZurvanLinux/.github/.github/workflows/lint.yml@main

Verification

• All YAML files parse.
• Reusable workflow lint.yml self-consistent.
• Self-lint run green (will add the caller + dispatch after merge to confirm shellcheck/yamllint pass on the org repo itself).
• Follow-up: wire the caller into iso-builder, apt-repository, website.