OSS maintainer polish: security, changelog, CI, architecture

[sysrootix]

This PR is maintainer hygiene for a public 1.0.0 macOS tool: community trust docs, changelog, architecture map, issue/PR templates, CI/release automation, stronger offline fixtures, and Settings → About links. It does not invent stars or users, add telemetry, or change how provider sessions are read (Keychain / unofficial usage endpoints stay as-is).

Why

A shipped MIT app with one release, ad-hoc signing, and zero issues/PRs still looks unfinished to reviewers (including OSS-program applications). These files are what a real public Mac utility is expected to have. Provider auth is intentionally untouched.

What changed

Community / trust

• SECURITY.md — private reports to sysrootix@gmail.com; in/out of scope (Keychain reuse and unofficial meters are not vulns by themselves; no token logging)
• CODE_OF_CONDUCT.md — Contributor Covenant 2.1
• CHANGELOG.md — Keep a Changelog, 1.0.0 (2026-08-29) plus Unreleased
• docs/ARCHITECTURE.md — App / Providers / UsageParsers / UsageService / UI / Settings, credential-read map, pointer to CONTRIBUTING for new providers
• Issue templates (bug / feature + config.yml) and PULL_REQUEST_TEMPLATE.md
• CONTRIBUTING.md — PR checklist, make test / make app / make zip, branch naming, never commit secrets, how to cut a release (git tag v1.x.x && git push --tags)

README

• Badges: CI, MIT, macOS 14+, Swift 6, release v1.0.0
• Why CheckUsage, Status (actively maintained; unofficial meters may break; links SECURITY + CHANGELOG), Roadmap → Issues
• Existing install / providers table / languages kept
• Community links; i18n READMEs got a short Status + docs line (English remains canonical)

CI / release

• ci.yml: concurrency cancel-in-progress, Homebrew cache, macos-15, Makefile still the source of truth, artifact upload only on main
• release.yml: on v* tags, make zip and attach CheckUsage.app.zip (create the GitHub Release if missing)
• Makefile zip target (ditto, macOS-only, same as app)

Tests (no network)

• Extra Claude / Codex / Cursor / Copilot fixtures that match current parser APIs (camelCase Codex, Cursor individualUsage + millis cycle, Copilot entitlement / chat / unlimited completions)
• BurnForecast and ResetCopy edge cases (on-track / hot / observed burn, 5h inferred start, past reset → Refresh, 6h compact boundary)

Product (low-risk)

• Settings → About already used CFBundleShortVersionString; now via AppInfo plus clickable GitHub / Issues / License links (localized in all ExtraL10n tables)

Verification

YAML for both workflows parses. This cloud agent is Linux, so make test / make app cannot run xcodebuild here. macos-15 CI on this PR is the compile/test gate.

Out of scope / deferred

• Opening the first GitHub Issues (roadmap items) — do this after merge
• Notarization / Developer ID signing
• New providers that need live unofficial APIs
• Fake screenshots or download counts
• Changing Keychain reuse or unofficial usage endpoints

How to release after this lands

# bump version in Info.plist + project.yml, move Unreleased in CHANGELOG
git tag v1.x.x
git push origin v1.x.x