Establish contribution governance before enabling CLA enforcement

PR #1 adds CLA enforcement, but repository evidence does not yet show an explicit external contribution path. The README has no contribution instructions, there is no CONTRIBUTING.md, SECURITY.md, or CI workflow, main is not protected, and the only current contributor is the repository owner. The MIT LICENSE is present.

Before merging PR #1 or making its CLA check required:

1. Confirm in README or CONTRIBUTING.md that external contributions are accepted, and document review, test, and CLA steps.
2. Add CI for python3 -m unittest discover -s tests and document the required checks.
3. Add SECURITY.md with a vulnerability reporting contact.
4. Protect main and the cla-signatures branch, then run a smoke test for signing, refresh, and merge-lock behavior.
5. Confirm the legal owner and the CLA document version.

Keep PR #1 open until these prerequisites are complete. Do not add a new license or silently enforce a CLA without owner confirmation.

Please name at least two maintainers who will review security and CLA changes.

Start with the README, then check whether CONTRIBUTING.md, SECURITY.md, and a CI workflow exist. Run python3 -m unittest discover -s tests and review the requested signing, refresh, and merge-lock smoke tests. Done means contribution, review, test, CLA, security-reporting, required-check, branch-protection, and ownership requirements are documented and confirmed by maintainers.