docs: add CONTRIBUTING, CLA, CoC, CONTRIBUTORS and CLA workflows (#18)

[millerjp]

Summary

Closes Phase 5 Part 2 — governance documentation + CLA Assistant automation + contributors regenerator. This is the last remaining issue in the v1.0.0 roadmap.

Closes #18.

What's in this PR

File	State
CONTRIBUTING.md	new — syncmap-specific, not a mask copy. Agent-gate stack split per-commit vs per-issue.
CLA.md	new — mask template with syncmap repo refs; Apache Licence 2.0 grant unchanged.
CODE_OF_CONDUCT.md	new — Contributor Covenant v2.1, oss@axonops.com enforcement contact.
CONTRIBUTORS.md	new — script-generated; TestGovernance_ContributorsFileIsGenerated enforces byte-equality.
signatures/version1/cla.json	new — empty signedContributors skeleton.
scripts/generate-contributors.sh	new — idempotent jq-driven regenerator.
.github/workflows/cla.yml	new — CLA Assistant (requires CLA_ASSISTANT_PAT secret).
.github/workflows/contributors.yml	new — triggers on signature commits; runs generator; pushes back.
.github/workflows/ci.yml	markdownlint globs extended to include new docs.
scripts/gen-llms-full.sh	updated to include CONTRIBUTING.md.
llms-full.txt	regenerated — 6308 words.
documentation_test.go	+7 governance tests (Contributing / CLA / CoC / CLAWorkflow / ContributorsWorkflow / ContributorsFileIsGenerated / SignaturesFileIsValid).

Operational prerequisite

The cla.yml workflow requires a CLA_ASSISTANT_PAT repository secret with admin:repo scope to bypass branch protection when it commits signatures. Create it manually at Settings → Secrets and variables → Actions before the first external PR lands. Without the secret, the workflow will run but the signature-push step will fail.

Local validation

$ make check
(all gates green, coverage 100%)

$ go test -race -run 'TestGovernance_' -v ./...
all 10 governance tests PASS

$ ./scripts/generate-contributors.sh signatures/version1/cla.json /tmp/regen.md
$ diff CONTRIBUTORS.md /tmp/regen.md
(zero diff — script output matches committed file)

$ ./scripts/gen-llms-full.sh && make llms-full-check
(zero diff — idempotent)

$ npx markdownlint-cli2 --config .markdownlint-cli2.yaml CONTRIBUTING.md CLA.md CODE_OF_CONDUCT.md CONTRIBUTORS.md
Summary: 0 error(s)

$ actionlint .github/workflows/*.yml
clean

Agent gates

• docs-writer (post) — initially flagged a CLA path typo (signatures/cla/cla.json → signatures/version1/cla.json), an agent-gate ordering issue in CONTRIBUTING (non-negotiable vs per-commit bucketing), and an American-spelling License in CONTRIBUTING's footer. All three fixed.
• go-quality — 8/8 PASS.
• commit-message-reviewer — PASS (subject 68 chars).

v1.0.0 readiness

Merging this PR closes the last v1.0.0 roadmap item. After merge, the repo is ready for release via workflow_dispatch of release.yml — the workflow runs the full gate, creates the tag from github-actions[bot], runs GoReleaser, and warms the Go module proxy.

Test plan

• All CI jobs green — including the newly expanded Markdown lint globs and the 10 TestGovernance_* tests
• llms-full.txt is up to date job passes against the regenerated file
• No new documentation drift in documentation_test.go