Add community health files for public contributors

SECURITY.md routes vulnerability reports to private GitHub advisories; the issue
and pull-request templates prompt for a user story, reproduction steps, and the
gate-green plus no-secrets checklist every change needs. Repos that lacked a
CONTRIBUTING.md now carry one that points at the repo's own rules and gate.

Author: unlucio

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,26 @@
+---
+name: Bug report
+about: Something does not work the way it should
+title: ""
+labels: bug
+---
+
+**What happened**
+A clear description of the bug.
+
+**What you expected**
+What you thought would happen instead.
+
+**Steps to reproduce**
+1.
+2.
+3.
+
+**Environment**
+- Printer model and firmware version:
+- Bespok3d app version:
+- Plugin and version (if the bug is in a plugin):
+- Your computer's OS (for a desktop-app bug):
+
+**Logs or screenshots**
+Anything that helps us see the failure. Please redact tokens, keys, and real network addresses.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,18 @@
+---
+name: Feature request
+about: Suggest a capability or an improvement
+title: ""
+labels: enhancement
+---
+
+**The problem**
+What are you trying to do that is hard or impossible today?
+
+**The idea**
+What would you like Bespok3d to do?
+
+**Who it helps**
+As a [role], I want [capability] so that [value].
+
+**Alternatives**
+Anything you have already tried or considered.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,20 @@
+## What this changes
+
+Briefly: what does this PR do, and why?
+
+## User story
+
+As a [role], I want [capability] so that [value].
+
+## Checklist
+
+- [ ] Scoped to the story above; no unrelated changes.
+- [ ] The repo gate passes green locally (see CONTRIBUTING.md for the command).
+- [ ] Ships a regression test that fails on the old behavior and passes on the fix.
+- [ ] No em-dash or en-dash anywhere (RULE ZERO); the gate enforces it.
+- [ ] Docs updated if this changes behavior, a boundary, or configuration.
+- [ ] No real secret, token, key, or LAN address in the diff.
+
+## Notes for the reviewer
+
+Anything that helps the review: a tricky decision, a follow-up you are deferring, an open question.

CONTRIBUTING.md

@@ -0,0 +1,46 @@
+# Contributing
+
+Thanks for working on a Bespok3d plugin. Bespok3d is a printer-agnostic plugin manager for Klipper
+printers that runs on stock firmware, with no custom-firmware flashing. This repo publishes one or
+more plugins as signed `.b3` packages that the desktop app installs onto a printer through the
+on-printer daemon. See [README.md](README.md) for this repo's layout, build, and release mechanics.
+
+## Before you write code
+
+Read [CLAUDE.md](CLAUDE.md). It is the contract for changes here: the plugin model (a plugin declares
+WHAT the printer should end up with, never a script that runs on the printer), the non-negotiables
+(RULE ZERO: no em-dash or en-dash; every identifier carries domain meaning; nesting beyond one level
+is suspicious; rule of three; extend upstream additively; never commit a real secret or LAN value),
+and the working procedure. If you use an AI assistant (many contributors do), point it at that file;
+`AGENTS.md` sends non-Claude tools there too.
+
+## Develop
+
+```sh
+bash scripts/check.sh
+```
+
+The gate needs the `lib_bespok3d` submodule; if you cloned without it, run
+`git submodule update --init` first. It runs the shared workspace detectors (the em-dash guard,
+workflow-pinning, shellcheck) plus whatever language layer the plugin ships (ruff, mypy, and pytest
+for a plugin that carries Python). Run it before every push; CI runs the same gate and blocks a
+release on failure.
+
+## Release
+
+Bump a plugin's `manifest.json` `version`. On merge, the `b3-builder` CI Action packs the `.b3`,
+signs it, cuts a release, and registers it in the org index. Do not hand-edit `index.json`, the
+`.atom.json`, `index.json.sig`, or anything under `dist/`: those are generated and signed by CI.
+
+## What a good change looks like
+
+- Scoped to a clear user story; only what the story needs.
+- Follows the rules in CLAUDE.md; passes the gate green.
+- Ships a regression test where the repo has a test layer for the behavior, in the same change.
+- Keeps the plugin's `doc/README.md` and `doc/CHANGELOG.md` current when it changes behavior or config.
+
+## Constraints
+
+- The maintainer owns git history and releases; submit changes as a pull request against `dev`.
+- Never SSH-mutate or reconfigure a live printer without explicit authorization; a serial port on a
+  printer may be a live Klipper MCU link. Read-only diagnosis is fine.

SECURITY.md

@@ -0,0 +1,30 @@
+# Security Policy
+
+Bespok3d installs signed packages onto a networked 3D printer and runs an on-printer daemon that
+handles authentication and fleet access, so we take security reports seriously.
+
+## Reporting a vulnerability
+
+Please report security issues privately, not in a public issue or pull request.
+
+Use GitHub's private vulnerability reporting: open this repository's **Security** tab and choose
+**Report a vulnerability**. That opens a private advisory only the maintainers can see.
+
+Tell us what you found, how to reproduce it, and what an attacker could do with it. We will
+acknowledge your report as quickly as we can and keep you posted while we work on a fix.
+
+## What matters most
+
+Bespok3d runs on stock printer firmware and never flashes custom firmware. The reports we care about
+most are:
+
+- a plugin package that can run unintended code on the printer,
+- a way to install or activate a package without a valid signature,
+- a way to bypass the daemon's authentication or reach a printer that is not yours,
+- a way to leave a printer unusable from a remote request.
+
+## Please do not
+
+- open a public issue for a security bug,
+- test against a printer or daemon you do not own,
+- run denial-of-service or destructive tests against shared infrastructure.