[larspohlmann]

Closes #21

What & why

Prepares the GitHub side for the first release (v0.1.0):

• README restructured into a landing page: badges, hero example, quickstart, compact CLI reference, short feature sections. Deep reference material moved (verbatim, not reworded) to docs/configuration.md (config keys, index cache, performance) and docs/baseline.md (fingerprints, adoption story, --changed-only interaction).
• Community health files: .github/CONTRIBUTING.md, CODE_OF_CONDUCT.md (Contributor Covenant 2.1), .github/SECURITY.md, issue forms (bug/feature), PR template.
• One stale link in docs/ci.md retargeted; --no-config and --dump-index documentation restored in docs/configuration.md after review (follow-up for the --help heredoc: Help text and README CLI block omit --no-config and --dump-index #22).

Design spec and implementation plan are committed under docs/superpowers/.

Maintainer action required after merge: enable private vulnerability reporting once under Settings → Code security, or the link in SECURITY.md will 404.

Checklist

• composer check is green (cs + stan + md + test — 526 tests, 1737 assertions)
• composer infection:diff — n/a, no src/ changes on this branch (verified: diff touches only docs and .github/)
• Semantic changes come with a fixture — n/a, documentation only; frozen-semantics prose moved verbatim (verified byte-for-byte in review)
• Title is a conventional commit with the issue number
• Targets develop (never main)