docs(contributing): add structured PR process — issue-first, QA cycle, commit format

[halindrome]

Closes #84

Summary

This PR documents the contributor workflow first demonstrated in PR #72, which the maintainer described as showing "real engineering discipline." The goal is to give future contributors a clear, reusable playbook for structuring PRs and validating their own work before submission.

Changes to CONTRIBUTING.md:

• Commit Format section — documents the conventional commit convention (type(scope): description) already used throughout the project history, with a type reference table
• Pull Request Guidelines — tightened to a focused technical checklist (C code only, one logical change, tests, lint)
• Pull Request Process section — numbered 4-step submission process: open issue first → describe changes → test against a real project → QA review
• QA Review Process — Step A/B/C cycle adapted from PR fix(store): keep WAL journal mode during bulk write to prevent DB corruption on crash #72's approach: run a fresh top-tier model session per round, fix findings in a separate commit per round (fix(scope): address QA round N), paste each report as a PR comment to prove the work. Minimum 3 rounds for logic-touching PRs. Docs-only PRs are explicitly exempt.

Notes

This PR is docs-only (changes to CONTRIBUTING.md only) and is therefore exempt from the QA round requirement per the policy being introduced.

[DeusData]

Thanks @halindrome — this was a thoughtful PR. CONTRIBUTING.md was rewritten during the v0.5.5 security hardening session and now covers build setup, testing, linting, security audit, project structure, language support workflow, and PR guidelines.

The commit format table and issue-first requirement from your PR are good ideas that we may incorporate later. The QA round workflow with AI model prompts, while creative, is too prescriptive for a general CONTRIBUTING guide — different contributors use different tools.

Closing since the parent issue #84 is already resolved and the guide covers the essentials. Your PR #72 (WAL fix) remains the gold standard for how we'd like PRs structured — thanks for setting that example.