Repo: add maturity baseline

Author: febrinanda

.github/CODEOWNERS

@@ -0,0 +1,8 @@
+# CoreBlow Code Owners
+
+* @febrinanda
+
+# Security-sensitive surfaces
+SECURITY.md @febrinanda
+.github/workflows/ @febrinanda
+.github/dependabot.yml @febrinanda

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,25 @@
+name: Bug report
+description: Report a focused CoreBlow issue
+title: "[Bug]: "
+labels: [bug]
+body:
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: What happened?
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: validation
+    attributes:
+      label: Validation
+      description: Commands, logs, or CI links. Do not include secrets or private data.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security report
+    url: https://github.com/coreblow/trust
+    about: Report sensitive findings through the CoreBlow trust process.

.github/dependabot.yml

@@ -0,0 +1,8 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - dependencies

.github/pull_request_template.md

@@ -0,0 +1,13 @@
+## Summary
+
+- TODO
+
+## Validation
+
+- [ ] CI passes
+- [ ] Relevant local checks were run
+- [ ] No secrets, private paths, phone numbers, or live configuration were added
+
+## Notes
+
+- TODO

CONTRIBUTING.md

@@ -0,0 +1,15 @@
+# Contributing to Corekit
+
+Thank you for helping improve CoreBlow.
+
+## Expectations
+
+- Keep changes scoped and reviewable.
+- Use CoreBlow branding in docs and examples.
+- Do not change versions, tags, or release metadata unless a maintainer explicitly asks.
+- Do not commit secrets, phone numbers, private hostnames, or live configuration.
+- Prefer tests or validation commands that match this repository's CI.
+
+## Pull Requests
+
+Open a focused pull request with a short summary, validation evidence, and any known follow-up work.

SECURITY.md

@@ -0,0 +1,14 @@
+# Security Policy
+
+Corekit follows the CoreBlow security policy.
+
+## Reporting
+
+Do not open a public issue for secrets, credential exposure, or exploitable behavior.
+Report sensitive findings privately to the CoreBlow maintainers.
+
+## Scope
+
+- Repository: https://github.com/coreblow/corekit
+- Product: CoreBlow
+- Public runtime secrets, phone numbers, private hostnames, and live credentials are never acceptable in issues, examples, or tests.