docs: add readme, changelog, security policy, and agent instructions

[SHSharkar]

Summary

Adds README, CHANGELOG, SECURITY, and matching CLAUDE.md/AGENTS.md files, since the phase 1
merge left the repository with no documentation describing the code that shipped.

Motivation

main had no README, changelog, security policy, or agent instructions after the phase 1 merge
deleted every markdown file. A private repository with no README still needs one for anyone
with access, and the public devops-infinity/ownpg-releases repository already needed an
accurate description of the private source it distributes.

Changes

• Added README.md: what OwnPG does, its pre-release status, install and quick-start commands,
  the configuration order, and the tool groups, each checked against the actual CLI and config
  source.
• Added CHANGELOG.md: an Unreleased section listing the current command surface and
  capabilities, since no version is tagged.
• Added SECURITY.md: points a vulnerability report at GitHub's private vulnerability
  reporting on devops-infinity/ownpg-releases, since this repository is private and a reporter
  cannot open an issue here.
• Added AGENTS.md and CLAUDE.md, identical text: the two-crate layout, the CI-enforced
  conventions (cargo fmt, cargo clippy -D warnings, the coverage floor, the banned-crate
  list), and a do/don't list tied to those checks.

Type of Change

• New feature (feat)
• Bug fix (fix)
• Refactoring (refactor)
• Documentation (docs)
• Performance (perf)
• Tests (test)
• Build/CI (build/ci)
• Chore (chore)
• Breaking change (append ! to type)

Testing

Test type:

• Manual testing performed

Steps to verify:

1. rg across all five files for an em dash, the CI house-rules wording pattern, a markdown
   table, and emoji: zero hits.
2. Every external link (keepachangelog.com/en/2.0.0, github.com/devops-infinity/ownpg-releases,
   github.com/SHSharkar) fetched directly: HTTP 200.
3. diff AGENTS.md CLAUDE.md: identical.

Checklist

• Code follows project conventions
• Self-review completed
• Tests added/updated
• Documentation updated (if applicable)
• No new warnings or errors
• Build passes locally
• PR title follows Conventional Commits

Additional Context

GitHub's private vulnerability reporting was off on devops-infinity/ownpg-releases despite its
own SECURITY.md already pointing there. It is now enabled, so the link this PR adds actually
works.

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can start a comment with 'qodo' or '@qodo' to chat about any finding

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-code-review]

PR Summary by Qodo

Add baseline project, security, and agent documentation

📝 Documentation 🕐 20-40 Minutes

AI Description

• Documents OwnPG installation, commands, configuration, capabilities, and pre-release status.
• Establishes vulnerability reporting and supported-version guidance through the public release
 repository.
• Adds synchronized agent instructions covering architecture boundaries and CI-enforced conventions.

Diagram

graph TD
  SRC["OwnPG Source"] --> README["README"] --> READERS["Users and Agents"]
  SRC --> CHANGELOG["Changelog"] --> READERS
  CI["CI Rules"] --> GUIDES["Agent Guides"] --> READERS
  SRC --> GUIDES
  SRC --> SECURITY["Security Policy"] --> RELEASES["Release Repository"]
  README --> RELEASES

Loading

High-Level Assessment

Adding focused root-level documents is the appropriate baseline for a repository that lost all Markdown documentation. Consolidating AGENTS.md and CLAUDE.md through a symlink or generation step was considered, but identical physical files maximize agent-tool discovery and avoid platform or workflow dependencies; reviewers should ensure future changes keep them synchronized.

Files changed (5) +232 / -0

Documentation (5) +232 / -0

AGENTS.mdAdd repository-wide AI agent instructions +41/-0

Add repository-wide AI agent instructions

• Defines instruction precedence, the two-crate architecture boundary, mandatory validation commands, and prohibited coding or dependency patterns. It also requires synchronization with CLAUDE.md.

AGENTS.md

CHANGELOG.mdDocument current unreleased capabilities +22/-0

Document current unreleased capabilities

• Introduces a Keep a Changelog-style Unreleased section describing the MCP transports, access and authentication modes, tool groups, connectivity, auditing, configuration, diagnostics, and generated shell assets.

CHANGELOG.md

CLAUDE.mdAdd Claude-compatible repository instructions +41/-0

Add Claude-compatible repository instructions

• Mirrors AGENTS.md so Claude-oriented tooling discovers the same architecture, validation, security, dependency, and contribution constraints.

CLAUDE.md

README.mdAdd project overview, installation, and usage guide +96/-0

Add project overview, installation, and usage guide

• Documents OwnPG's purpose, pre-release status, prerequisites, installation paths, quick-start commands, command surface, configuration precedence, tool groups, security behavior, support channel, and licensing.

README.md

SECURITY.mdEstablish vulnerability reporting and security scope +32/-0

Establish vulnerability reporting and security scope

• Defines supported versions, directs private reports to the public release repository's advisory channel, and lists in-scope security failures. It also summarizes credentials, authentication data, audit records, and telemetry handled by OwnPG.

SECURITY.md