CONTRIBUTING.md mandates an internal branch/commit convention that does not belong in public history

Problem/Motivation

Dual-venue record for GitHub #75.

CONTRIBUTING.md requires branches and commit subjects to carry an internal issue-tracker key, and declares that section authoritative over the rest of the file. Two problems:

• It contradicts the sibling modules. file_gate, menu_autopilot and graphql_compose_codegen all document plain descriptive branching off 1.x (feature/, fix/, chore/). A contributor moving between them gets contradictory instructions.
• It publishes internal operational detail. The section enumerates an internal tracker's project prefixes and points at an internal repository path. Neither is useful to an outside contributor — they cannot open or read any of it.

The file's own instructions are also not what the repository does: no recent commit on 1.x follows the mandated form. A convention nothing follows is a trap for whoever reads the file and complies.

Separately, the file has no security-reporting section at all, and the project ships no SECURITY.md, so a contributor who finds a vulnerability has no documented private route.

Proposed resolution

• Replace that section with the short branching note the sibling modules use: branch off 1.x with a descriptive feature/, fix/ or chore/ slug; PR into 1.x.
• Drop the tracker-prefix table and the internal repository reference entirely.
• Add the sections the file never had: coding standards, tests, changelog entry, security reporting.
• Add SECURITY.md with a private disclosure route.

Remaining tasks

Implemented in GitHub PR #84, awaiting review and merge.