chore(repo): initial baseline import (docs v0.9.2 + bootstrap)

Imports the v0.9.2 documentation baseline and the bootstrap files
required by docs/governance/repository-bootstrap-plan.md v0.1.0 §3,
minus the justfile (added in the next commit).

This commit establishes the git history for the project. All previous
work lived only as filesystem state with no version control.

CONTRIBUTING.md

@@ -0,0 +1,64 @@
+# Contributing to Chanora
+
+## Status
+
+Chanora is currently in early implementation preparation. Contributions should preserve the documentation hierarchy and product decisions.
+
+## Engineering hierarchy
+
+```text
+SysRS -> SysDes -> SRS -> SAD -> SDD
+```
+
+Do not bypass layers:
+
+- SRS shall not link directly to SysRS.
+- SAD shall not link directly to SysRS or SysDes.
+- SDD shall not link directly to SysRS, SysDes, or SRS.
+
+## Before making a change
+
+1. Identify the affected area: requirements, architecture, design, verification, release, security, privacy, legal, UI/UX, i18n, or implementation.
+2. Check the relevant document under `docs/`.
+3. Update downstream documents if the change affects traceability.
+4. Add or update verification expectations when behavior changes.
+5. Use the commit message convention in `docs/governance/git-commit-message-convention.md`.
+
+## Commit format
+
+Use Conventional Commits style:
+
+```text
+<type>(<scope>): <summary>
+```
+
+Examples:
+
+```text
+feat(voice): add push-to-talk state handling
+fix(protocol): recover channel tree after reconnect snapshot
+docs(sad): add interface catalog and performance view
+sec(diagnostics): redact server password from export bundle
+```
+
+## Pull request expectations
+
+A pull request should include:
+
+- summary of change;
+- affected documents or modules;
+- tests/checks performed;
+- related requirement/design IDs where applicable;
+- release/security/privacy/legal impact if applicable.
+
+## Do not include
+
+Do not commit:
+
+- secrets;
+- server passwords;
+- identity private keys;
+- local diagnostic bundles containing sensitive data;
+- generated build artifacts;
+- local IDE/cache files;
+- private signing keys or certificates.