fix: close roadmap audit gaps - real audit gate, schema tests, OSS templates

[suradet-ps]

Summary

Fixes all 5 gaps found in the ROADMAP.md audit:

1. bun audit is now a real CI gate — removed continue-on-error: true from ci.yml. To make it pass, cleared all 17 known advisories (1 critical, 16 high: tar, brace-expansion, postcss, sharp, undici, fast-uri, svgo, js-yaml) via dependency overrides in package.json (same pattern as the existing minimatch/path-to-regexp overrides).
2. Zod frontmatter schema tests — extracted the plain-Zod part of the schema from src/content.config.ts into src/lib/content-schema.ts (testable outside Astro's virtual modules), wired it back with extend(), and added 21 unit tests (content-schema.test.ts) covering required fields, invalid dates, invalid values, and unknown-field stripping. 55 tests total, all passing.
3. OSS standards — added CODE_OF_CONDUCT.md (Contributor Covenant 2.1), .github/PULL_REQUEST_TEMPLATE.md, and .github/ISSUE_TEMPLATE/ (bug report + feature request forms, security-reporting config). .github/** added to ESLint ignores since GitHub requires the ISSUE_TEMPLATE directory name.
4. Doc filename consistency — ROADMAP.md and README.md now reference docs/design.md, docs/security.md, docs/contributing.md, docs/agents.md in their actual lowercase form (uppercase links break on case-sensitive filesystems / Linux CI).
5. Stale versions fixed — ROADMAP.md updated 1.22.6 → 2.0.0.

Also: docs/CHANGELOG.md gained an [Unreleased] section.

Checklist

• bun run lint passes
• bun run test passes (55 tests, 5 files)
• bunx astro check passes (0 errors)
• bun run build passes
• bun run size passes (1.16 kB gzipped, budget 10 kB)
• bun audit --audit-level=high exits 0

Note on the v2.0.0 tag

The v2.0.0 git tag does not exist yet (repo is at v1.22.6). I'll create and push it on main right after this PR merges, so the tag points at the release commit including these fixes.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
rxdevnotes	Ready	Preview	Aug 2, 2026 11:23pm