Add project governance and policy docs

[LunaStev]

Summary

• add contribution, conduct, security, maintainer, copyright, notice, mailmap, and AI usage policies
• add a pull request template aligned with Vex reproducibility requirements
• link project policies from the README and ignore local .tmp/ release planning notes
• restore the MPL-2.0 license text header by removing an unrelated project label

Why

Vex is preparing for its first real v0.0.1 release. Contributors and users need clear project boundaries, review expectations, private reporting instructions, maintainership ownership, and distribution notices before release automation and artifacts are introduced.

Behavior

• documents that Vex owns manifests, dependency resolution, lockfiles, and compiler orchestration rather than forwarding raw wavec flags
• requires DCO sign-off for new contributions and documents GitHub and email patch workflows
• adopts a Contributor Covenant 2.1-based code of conduct
• establishes private security reporting guidance and current pre-release support status
• records maintainer responsibility by subsystem and normalizes existing author identities through .mailmap
• states copyright and notice information without changing MPL-2.0 rights
• records an AI crawling and training preference while explicitly making LICENSE controlling

No product source code or CLI behavior changes in this pull request.

Validation

• cargo fmt --check
• cargo test --locked
• cargo clippy --locked --all-targets -- -D warnings
• cargo build --locked
• git diff --check
• git check-mailmap for existing author identities
• verified .tmp/v0.0.1.md remains ignored