[kktbur]

Summary

This PR implements the v0.3.0 roadmap slice for ecosystem and repository governance.

• Add a user-facing Chinese README while keeping the English README canonical for the normative standard.
• Add visible README language navigation, contributor guidance, security reporting guidance, and issue/PR templates.
• Add the Unix bash scripts/check.sh verification wrapper and run it in CI.
• Add governance-document fixtures and keep the repository-local indexed knowledge current.
• Record the v0.2.0 release as the stable baseline and define the v0.3.0 candidate boundary.

Scope

Implemented roadmap items: WP-31, WP-32, WP-33, and WP-35.

WP-34 (renaming the standard filename) is intentionally deferred to a separate compatibility-reviewed PR.

No database, vector search, MCP server, Docker workflow, release automation, CLA, or broad architecture change is included.

Verification

Local standard-library checks pass, including:

• documentation audit and repository-link checks
• freshness check
• Plugin validation
• project-knowledge, public-example, README-navigation, governance, small-path, and version tests
• line-ending and active-name checks
• Python compilation
• git diff --check

The independent standards review found no actionable standards breach. Spec-review findings were addressed for the Unix wrapper, CI workflow naming, privacy cross-link, and private security-reporting route.

The fresh-session E2E criterion now passes: a safe restricted workspace-write/unelevated retry loaded the candidate Plugin in an Administrator-owned isolated empty Git project and completed INIT → UPDATE → AUDIT. The required knowledge skeleton was generated; document, link, freshness, Git-boundary, and no-commit checks passed; no application source was created. The original sandbox-helper failure was preserved as local evidence.

Release boundary

• Stable baseline: published v0.2.0 at merge commit 994b121.
• This PR contains candidate metadata 0.3.0.
• Do not tag or release v0.3.0 until this PR is reviewed and merged, then verify tag-triggered CI and the GitHub Release separately.
• Rollback target remains the published v0.2.0 release.

Please review the candidate changes, the fresh-session E2E evidence, and the explicit release boundary before merging.