chore: add PR/issue templates, SECURITY.md, CodeQL, dependabot configurator

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,42 @@
+name: Bug report
+description: Something in the SLASHED CSS framework is broken
+labels: [bug]
+body:
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened
+      description: What went wrong, and what you expected instead.
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: A minimal repro helps — link a CodePen/JSFiddle or paste the smallest HTML + classes/tokens that show the problem.
+      placeholder: |
+        1. Load `dist/slashed.css`
+        2. Markup: ...
+        3. Observed: ...
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: SLASHED version
+      description: The `/*! SLASHED vX.Y.Z */` header of the bundle you loaded, or the npm/release version.
+    validations:
+      required: true
+  - type: input
+    id: env
+    attributes:
+      label: Environment
+      description: Browser(s) and OS. Note if it's light or dark mode specific.
+      placeholder: Chrome 126, Firefox 128, Safari 17 — macOS 14
+    validations:
+      required: true
+  - type: textarea
+    id: extra
+    attributes:
+      label: Anything else
+      description: Console output, screenshots, or notes on which token/class is involved.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: SLASHED for WordPress (Bricks / Gutenberg integration)
+    url: https://github.com/codeslash-dev/SLASHED-Plugins/issues
+    about: Report issues with the WordPress plugin or its builders, not the CSS framework itself.
+  - name: Security vulnerability
+    url: https://github.com/codeslash-dev/SLASHED/security/advisories/new
+    about: Report security issues privately (see SECURITY.md). Do not open a public issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,36 @@
+name: Feature request
+description: Suggest a new token, class, macro, or framework improvement
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What are you trying to style or do that the framework makes hard or impossible?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: New token / class / macro, or a change to an existing one. Note if it's a PUBLIC or advanced API.
+    validations:
+      required: true
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - Core tokens / theme
+        - Layout primitives
+        - Components
+        - Optional layer
+        - Macros
+        - Configurator
+        - Docs / tooling
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,26 @@
+## Summary
+
+<!-- What does this change and why? -->
+
+## Type
+
+- [ ] fix
+- [ ] feat
+- [ ] docs
+- [ ] chore / tooling
+
+## Checklist
+
+- [ ] Conventional Commit messages (`feat:`, `fix:`, `docs:`, …) — enforced by commitlint
+- [ ] `npm run lint:css` passes (stylelint)
+- [ ] `npm run build` rebuilds `dist/` (bundles are git-ignored; CI rebuilds and stamps headers)
+- [ ] `npm test` passes (unit + Playwright e2e)
+- [ ] Version references in sync if any version-related file changed (`npm run check:version`)
+- [ ] LLM guide reviewed/updated if `core/*.css`, `optional/*.css`, or `token-registry.json` changed (`npm run check:llm-guide`)
+- [ ] Generated artifacts regenerated, not hand-edited (`npm run check:macros`, `check:registry`, `audit:check`)
+- [ ] `CHANGELOG.md` updated under `## [Unreleased]` (for user-facing changes)
+- [ ] Breaking changes include migration docs
+
+## Notes
+
+<!-- Screenshots, manual testing, known limitations. -->

.github/dependabot.yml

@@ -9,3 +9,8 @@ updates:
     directory: /
     schedule:
       interval: weekly
+
+  - package-ecosystem: npm
+    directory: /configurator
+    schedule:
+      interval: weekly

SECURITY.md

@@ -0,0 +1,24 @@
+# Security Policy
+
+## Supported versions
+
+Only the latest released version of SLASHED receives security fixes. Update
+before reporting.
+
+## Reporting a vulnerability
+
+Report privately — **do not open a public issue or PR.** Use
+[GitHub Security Advisories](https://github.com/codeslash-dev/SLASHED/security/advisories/new).
+
+Please include:
+
+- affected version (the `/*! SLASHED vX.Y.Z */` bundle header or release tag);
+- which artifact is affected (CSS bundle, `configurator/` app, or build tooling);
+- steps to reproduce or a proof of concept;
+- impact.
+
+Vulnerabilities in the WordPress integration belong in the
+[SLASHED-Plugins repo](https://github.com/codeslash-dev/SLASHED-Plugins/security/advisories/new).
+
+We aim to acknowledge a report within a few days, share a fix timeline once
+triaged, and credit reporters in the release notes unless you prefer otherwise.