GH-015 — Security, authorization and release governance

[marcialwushu]

Summary

• publish maintainer, contributor, release-manager, and security-reviewer responsibilities
• add PromptLogRedactor with conservative masking and DI registration
• add CLI release-check for diff-based SemVer classification and immutable-artifact enforcement
• require one semver:* declaration through the release-governance workflow
• validate concrete package-version transitions before both pack workflows
• add security reporting, PR checklist, release/compliance checklist, and rollback policy
• update the task index and changelog

Validation

• Release solution build: 0 warnings, 0 errors
• 58 tests passed across PromptKit, Prompts, contract, and CLI suites
• CLI repository validation passed
• actionlint passed for all workflows
• PromptKit and Prompts packages created successfully with an explicit package version

SemVer

MINOR: adds compatible public redaction and release-governance capabilities without removing existing pins or APIs.

Implements GH-015.