Add organization community templates and contact links

[fastrevmd-lab]

Summary

Adds organization-wide issue and pull request templates, community contact links, and a newcomer contact section in the organization profile.

Verification

• git diff --check
• Reviewed GitHub issue-form YAML structure and Markdown locally

Merge note

Manual board merge required for mechubsec/.github; the PR loop does not watch this repository.

[fastrevmd-lab]

Verdict: changes requested (one small fix; everything else is good)

Finding: the default bug report form doesn't ask reporters to redact device data (data-escape / leak path; severity medium, likelihood high)

• Evidence: .github/ISSUE_TEMPLATE/bug_report.yml asks for "What happened?" and "Steps to reproduce" with "include relevant context", and never asks reporters to sanitize anything. Our audience runs firewalls, so "relevant context" usually means a pasted config snippet, log, or error text containing hostnames, IPs, serials, usernames, or key material. Public issues are indexed straight away, and deleting one later doesn't take it out of caches or notification emails.
• This would be a step back. The per-repo forms in mecmcp, rustjunosmcp and rustunifimcp already carry this warning. The org default applies to every repo without its own template, including new ones, so those repos would lose it.
• Fix: add a notice block and a required checkbox at the top of body:.

  - type: markdown
    attributes:
      value: |
        **Do not paste real device data.** Redact hostnames, IP addresses, serial numbers, usernames, credentials, keys, SNMP communities, and free-text descriptions from configs, logs, and error output before posting. Security problems go through [SECURITY.md](https://github.com/mechubsec/.github/blob/main/SECURITY.md), not public issues.
  - type: checkboxes
    id: redaction
    attributes:
      label: Data hygiene
      options:
        - label: I have removed real hostnames, IPs, serials, credentials, and other device data from this report.
          required: true

Put a one-line version of the same notice in the "What happened?" and "Steps to reproduce" description: fields.

• Residual risk: people can still tick the box and paste anyway. The warning lowers the odds but can't prevent it.

Non-blocking nits

• feature_request.yml makes Version and Expected result required. A version doesn't mean much for a feature request, and the second question repeats "What do you propose?". Make Version optional or drop it.
• labels: ["bug"] / ["enhancement"] are only applied in repos where those labels exist; GitHub skips them silently elsewhere. Nothing to change, just so it isn't a surprise.

Checks run

• I read the full diff (8 files), the PR title and description, and all 5 commit messages. Everything is class-level, with nothing to reword.
• config.yml contact links: SECURITY.md exists on main and sends reports to GitHub Private Vulnerability Reporting, which is turned on for mecmcp, rustjunosmcp, rustunifimcp, ssdf and fwconfigsanitizer. Org Discussions are on (the .github repo has discussions enabled, and the URL returns 200). blank_issues_enabled: false is fine.
• profile/README.md: all 8 linked repos exist and are public.
• The PR template's checklist includes the class-level wording and no-secrets items. Good.
• No new outbound calls, workflows, or executable content. Only Markdown/YAML. The badge URLs in README-TEMPLATE are shields.io links shown on GitHub, not something our tools call.
• CI: CodeQL (actions) pass, gitleaks pass.

Once the redaction notice is in, this is an approve. No other changes needed.

[fastrevmd-lab]

Addendum (Percy), non-blocking: README-TEMPLATE.md sets Alpha to status-alpha-blue and forbids other colours, but the profile maturity table on main uses status-alpha-orange. Make them agree, most simply by changing the template to alpha-orange. #13 duplicates this PR's template and style guide and I've recommended closing it in favour of this one, so any wording from it you want to keep should be picked into this PR. My verdict hasn't changed: once the redaction notice is in, this is an approve.