chore(config): governance and config foundation (#292)

* chore(config): governance and config foundation (PR #272 split 1/6)

Add repository governance and configuration files:
- CODEOWNERS: review authority model
- ISSUE_TEMPLATE: Copilot task template
- PULL_REQUEST_TEMPLATE: comprehensive review checklist
- .env.example: environment variable documentation
- .tool-versions: asdf/mise compatibility (Node 20, Python 3.12)
- .gitignore: expanded coverage (build, test, Python, tmp)
- .markdownlint.json: add MD009 trailing whitespace rule
- VERSION: 0.1.0

This is PR 1 of 6 from the PR #272 decomposition plan.
Dependency chain: PR-1 → PR-2 → PR-3 → PR-4/5/6 (parallel)

* chore(config): remove fork-specific CODEOWNERS from upstream PR

CODEOWNERS references @alfraido86-jpg (fork owner). Submitting this to
upstream would override @affaan-m's review authority. CODEOWNERS belongs
in the fork only, not in upstream contributions.

Ref: SAM finding F9 (run-048 audit)

* chore: address CodeRabbit review feedback on PR #292

- Scope markdownlint config to repo files (globs pattern)
- Add pre-commit hook checkbox to PR template

Ref: CodeRabbit review on PR #292

* fix(config): address CodeRabbit nitpicks N2 and N3

N2: Move pre-commit hooks checkbox higher in security checklist.
N3: Replace global MD009 disable with scoped config (br_spaces: 2).

* fix(config): use recursive glob for node_modules exclusion (N4)

.github/ISSUE_TEMPLATE/copilot-task.md

@@ -0,0 +1,17 @@
+---
+name: Copilot Task
+about: Assign a coding task to GitHub Copilot agent
+title: "[Copilot] "
+labels: copilot
+assignees: copilot
+---
+
+## Task Description
+<!-- What should Copilot do? Be specific. -->
+
+## Acceptance Criteria
+- [ ] ...
+- [ ] ...
+
+## Context
+<!-- Any relevant files, APIs, or constraints Copilot should know about -->

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,5 +1,14 @@
-## Description
-<!-- Brief description of changes -->
+## What Changed
+<!-- Describe the specific changes made in this PR -->
+
+## Why This Change
+<!-- Explain the motivation and context for this change -->
+
+## Testing Done
+<!-- Describe the testing you performed to validate your changes -->
+- [ ] Manual testing completed
+- [ ] Automated tests pass locally (`node tests/run-all.js`)
+- [ ] Edge cases considered and tested
 
 ## Type of Change
 - [ ] `fix:` Bug fix
@@ -10,8 +19,15 @@
 - [ ] `chore:` Maintenance/tooling
 - [ ] `ci:` CI/CD changes
 
-## Checklist
-- [ ] Tests pass locally (`node tests/run-all.js`)
-- [ ] Validation scripts pass
+## Security & Quality Checklist
+- [ ] No secrets or API keys committed (ghp_, sk-, AKIA, xoxb, xoxp patterns checked)
+- [ ] JSON files validate cleanly
+- [ ] Shell scripts pass shellcheck (if applicable)
+- [ ] Pre-commit hooks pass locally (if configured)
+- [ ] No sensitive data exposed in logs or output
 - [ ] Follows conventional commits format
+
+## Documentation
 - [ ] Updated relevant documentation
+- [ ] Added comments for complex logic
+- [ ] README updated (if needed)