chore: adopt the standards baseline docs and config

[StuartMeeks]

What changed

STANDARD.md §1.9, §4.11, §5.2, §5.4, §5.7. No CI change, no ruleset work, no build behaviour change.

• global.json pins the SDK (10.0.100, rollForward: latestFeature), not just the MTP runner.
• .gitignore and .editorconfig replaced with the canonical copies.
• SECURITY.md added, with a rewritten scope section — see below.
• CONTRIBUTING.md, .github/PULL_REQUEST_TEMPLATE.md, CLAUDE.md added.

Why

§1.9 — an unpinned SDK means a contributor on an older one gets different analyzer results from CI, and TreatWarningsAsErrors turns that into a build that fails for them and passes for everyone else.

§5.2 — the canonical .editorconfig carries one substantive fix over this repo's copy: the private-field naming rule matched constants, because a const is a field under applicable_kinds = field, so it demanded _nonceSize for private const int NonceSize. An empty required_modifiers scopes it to instance fields. EnforceCodeStyleInBuild is off (§1.2.1 is blocked), so this changes no build outcome today and is correct for when it does.

The canonical .gitignore is this repo's own, upstreamed as the canonical copy — the only delta is dropping a duplicate trailing artifacts/ the canonical file already covers twice. Verified artifacts/ is still ignored (git check-ignore resolves to .gitignore:237).

§4.11 — SECURITY.md is deliberately not the template verbatim. Reporting and Supported versions are; Scope is rewritten, because the template's scope is about credential storage and would have described types this package does not contain. A security policy describing the wrong library is worse than none. The replacement states what is actually claimed here:

• SHA-256 verification gives integrity, not authenticity — the expected hash ships from the same release as the asset, and there is no signature checking.
• AllowInsecureManifestSource and UseDefaultSha256Verifier = false defeat verification by design and are documented as tests/trusted-network only.
• Archive path-traversal defence is ZipFile/TarFile's guard, not this library's.
• GhCliReleaseSource trusts whatever gh is on PATH.

§5.7 — CLAUDE.md points at the standards repo for the baseline rather than restating clauses locally (a local copy of a clause is a copy that drifts), and spends its repo-specific section on things an agent would otherwise get wrong: why the three-platform matrix is load-bearing here, why one install-lock test returns early on Windows by design, and that PackageValidationBaselineVersion tracks the last shipped release.

Checklist

• Build is clean — no new warnings (TreatWarningsAsErrors is on)
• Tests pass on every shipped target framework — 392 tests, 196 × net8.0/net10.0, verified locally on the pinned SDK
• Public API changes carry XML docs — n/a, no code change
• CHANGELOG.md updated under [Unreleased]
• Dependency floors unchanged

Consumer impact

None. No change to the library, its public surface, or the package contents. <Version> is untouched and no tag is pushed.

🤖 Generated with Claude Code