fix(pr-template): generalize org-wide PR template

[sbaerlocher]

Summary

• Replace the fixed role checklist (Alloy, DO, Tailscale) with a free-form ## Affected Component(s) list — the checklist came from ansible.agent and is meaningless in every other repository the org-wide template applies to.
• Remove the trailing comment block: it thanked contributors for the wrong repository and carried an attribution line the commit conventions forbid, which every PR in the organization inherited.
• Apply both changes to the copy under templates/ so the org-wide default and the bootstrap source for new repositories stay in sync.

The duplication itself was checked for replacement by a symlink and deliberately kept: templates/ is copied out into new repositories, where a link pointing back into this repo would not resolve, and GitHub reads only the root file for the org-wide default.

Test plan

• Rendered template no longer names roles specific to a single collection
• No attribution line or wrong-repository reference remains in either copy
• Both copies are byte-identical
• CI green

[claude]

The template change itself is correct and well-scoped: the role-specific checklist is genuinely meaningless for the org-wide default, the removed comment block referenced the wrong repo, and both copies are byte-identical as verified.

One open item: this changes a template inherited by every org repository, but there's no matching CHANGELOG.md entry. AGENTS.md lists updating CHANGELOG.md under Do, and the rolling CHANGELOG already tracks template-level changes. Please add a dated entry describing the generalization.

[claude]

All raised issues have been addressed — the CHANGELOG entry is now in place.

[claude]

All raised issues have been addressed. The security fixes in security-code.yml (env-passthrough for inputs, package-manager allowlist, printf-based summary) are correct, the pre-build-commands removal is properly documented, and the CHANGELOG entry covers all changes.