chore: adopt the standard docs, editor config and SDK pin

[StuartMeeks]

What changed

PR B of the NextIteration.Standards adoption sequence (ADOPTING.md step 2). Touches no CI and needs no ruleset work.

• SECURITY.md (§4.11), CONTRIBUTING.md and .github/PULL_REQUEST_TEMPLATE.md (§5.4), CLAUDE.md (§5.7).
• Canonical .gitignore and .editorconfig (§5.2), both byte-identical to templates/.
• global.json gains the SDK pin (10.0.100, rollForward: latestFeature) alongside the existing Microsoft.Testing.Platform runner setting (§1.9).

SECURITY.md and CLAUDE.md are written for this repo, not copied — a generic one is worth nothing. The security scope section is narrow because the surface is: this library opens no file, socket, or OS store, so the only real boundary is terminal control sequences reaching the console through the two caller-controlled paths (AppName via Figgle, and a FromProvider tagline). CLAUDE.md's "easy to get wrong" list names the five invariants that are silent when broken — the single-Markup-call design, the markup escaping, the duplicated line-ending normalisation, Gradient trusting SplashColors to have already validated, and spaces skipping the colour escape.

Two of the .gitignore additions earn their place specifically here: **/[Cc]:/ catches the stray directory this repo's Windows-style PackageOutputPath creates on Linux — PR C removes that at the source — and artifacts/ matches where §1.8 puts pack output.

Why

§5.2, §5.4, §5.7 and §4.11 were all failing. The SDK pin (§1.9) matters more than it looks: without it a contributor on a different feature band gets different analyzer results from CI, and TreatWarningsAsErrors turns that into a build that fails for them and passes for everyone else.

Accuracy fixes required by §5.3

• README now states its target frameworks and dependency floors, and says why the floors are not per-TFM — §1.5 applies here, not §1.4, because every dependency is pre-1.0 and versions independently of the .NET runtime.
• SplashTagline.RandomBuiltIn's XML doc said "~200 quotes". The pool holds 313, counted from Quotes.cs; the README already said "~300". Corrected to match. Documentation only — the pool itself is untouched.

Verification

Local, at this commit: dotnet build --configuration Release — 0 warnings, 0 errors; dotnet test -- --coverage — 80 passed, 0 failed on both net8.0 and net10.0.

Consumer impact

None to behaviour. One shipped file changes content: the generated XML documentation, because of the ~200 → ~300 doc fix above. No public signature, no dependency floor, and no runtime code changes.

Checklist

• Build is clean — no new warnings (TreatWarningsAsErrors is on)
• Tests pass on every shipped target framework
• Public API changes carry XML docs — no API change; one existing doc corrected
• CHANGELOG.md updated under [Unreleased]
• Dependency floors unchanged

🤖 Generated with Claude Code