Prepare repo for open source

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Default maintainer review for repository-wide changes.
+* @Samraaj

.github/ISSUE_TEMPLATE/bug_report.md

@@ -25,3 +25,7 @@ labels: bug
 **Logs / artifacts**
 <!-- Relevant output, the validation report, or a run dir. For a "perfect score",
      check it isn't a blocked/degenerate capture (capture.pollution / capture.blocked). -->
+
+**Responsible disclosure**
+<!-- Do not include secrets, cookies, private URLs, proprietary captures, or security
+     vulnerabilities here. Report vulnerabilities privately via SECURITY.md. -->

.github/ISSUE_TEMPLATE/config.yml

@@ -3,3 +3,6 @@ contact_links:
   - name: Security vulnerability
     url: https://github.com/ion-design/ditto.site/security/advisories/new
     about: Please report security issues privately — do not open a public issue.
+  - name: Support policy
+    url: https://github.com/ion-design/ditto.site/blob/main/SUPPORT.md
+    about: Read what information to include and what support expectations apply.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -17,3 +17,7 @@ labels: enhancement
 **Scope notes**
 <!-- Does this touch the deterministic compiler (clone fidelity/gates) or only the
      service layer? Anything that affects clone output should stay deterministic. -->
+
+**Responsible-use impact**
+<!-- Note any safeguards needed for public clone endpoints, third-party captures,
+     brand/trademark confusion, or abuse prevention. -->

.github/pull_request_template.md

@@ -10,8 +10,15 @@
 
 - [ ] `npm run typecheck` passes
 - [ ] `npm test` passes
+- [ ] `npm audit --omit=dev --audit-level=moderate` passes, or residuals are explained
 - [ ] Added/updated tests for the change
 
+## Open-source readiness
+
+- [ ] Documentation updated where behavior, setup, deployment, or support expectations changed
+- [ ] No secrets, private URLs, proprietary captures, or generated artifacts were committed
+- [ ] Change follows the responsible-use policy
+
 ## Compiler determinism
 
 - [ ] No change to the compiler's deterministic clone semantics, **or** the change

.github/workflows/ci.yml

@@ -5,9 +5,13 @@ on:
     branches: ["**"]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     services:
       postgres:
         image: postgres:16