[2.0] Repo setup: protect dev-v2 and add contributor docs #4

Before more people (and agents) start working on 2.0, the repo needs a few basics. All 2.0 work goes into dev-v2 (already cut from dev). I've already done the GitHub settings by hand. What's left is the files. The only security notes live in .opencode/SECURITY.md, which is gitignored, so nobody else can see them (it's there in my local checkout).

• Protect dev-v2: PRs only, linear history, no force pushes or deletion (ruleset protect-dev-v2; 0 required approvals since I can't approve my own PRs; the required status check gets added with CI: run tests and lints on every PR #7)
• Allow only rebase merging in the repo settings (turn off squash and merge commits), and delete branches after merge
• Add dev-v2 to the push triggers in CI.yml (PRs into any branch already run CI)
• Add CONTRIBUTING.md (build/test commands, branch from dev-v2 as wp<N>-<name> and PR back into it, Conventional Commits, every commit passes on its own, review fixes go into the commit they fix with --fixup and a rebase)
• Add a PR template with the checklist from AGENTS.md
• Add .github/CODEOWNERS so I'm requested as reviewer on src/ and SECURITY.md
• Move the findings from .opencode/SECURITY.md into a root SECURITY.md, and add a section on how to report a vulnerability (GitHub private reporting is already on; point people to the repo's Security tab)
• Commit AGENTS.md, CLAUDE.md, PLAN-2.0.md and opencode.json (docs: add 2.0 plan and agent instructions #19)

Done when: a new contributor can clone, read CONTRIBUTING.md, and open a PR against dev-v2 that CI checks.

Moving the default branch to main isn't part of this issue. That happens at the end, when I merge dev-v2 into main.

Plan: WP-0 in PLAN-2.0.md.

Part of #3.