Package for public GitHub release

Add open-source scaffolding and CI; remove Claude-specific dev notes from the
published tree.

- Remove CLAUDE.md from tracking (kept locally, now git-ignored).
- CHANGELOG.md (Keep a Changelog; v1.0 → v1.1.1).
- SECURITY.md (private vuln reporting + operator guidance).
- CONTRIBUTING.md (dev setup, conventions, PR flow).
- .github/: bug + feature issue templates, PR template.
- .github/workflows/ci.yml: byte-compile, validate example config, docker build.
- .github/workflows/release.yml: on a version tag, publish a multi-arch
  (amd64 + arm64) image to GHCR.
- README: license/release/CI badges, prebuilt-image (GHCR) run instructions,
  and a corrected Python-version note (3.9–3.11; netifaces caveat).

Badges and image names use an `OWNER` placeholder to replace with the GitHub
namespace after the repo is created.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,19 @@
+## Summary
+
+<!-- What does this PR change, and why? -->
+
+## Related issues
+
+<!-- e.g. Closes #123 -->
+
+## How was this tested?
+
+<!-- Commands run, manual steps, screenshots. For Docker changes, note that
+     `docker build` succeeds. -->
+
+## Checklist
+
+- [ ] Server starts and the change works locally (`python3 server.py`)
+- [ ] If admin assets changed, bumped the `?v=` cache-bust token in `admin/admin.html`
+- [ ] If behavior/version changed, updated `VERSION` and `CHANGELOG.md`
+- [ ] No secrets or local config committed (`config.json` stays ignored)