Guidelines for commits, pull requests, CI workflows, and secure dependency management.

• Emphasizes atomic, focused commits with clear messages; recommends git rebase -i for clean history and avoiding mixed logic/formatting changes
• PR best practices include keeping changes small and focused, running tests before submission, and using WIP states in GitHub Actions when needed
• Security checklist: never commit .env files, credentials, or secrets
• Dependency additions require a license file in licenses/ and an entry in NOTICE.md
• External API/tool usage should rely on official documentation rather than guessing parameters