chore: add issue forms, SECURITY.md, CODEOWNERS and labels

.claude/skills/README.md

@@ -17,4 +17,4 @@ These skills are opinionated about safety and never: run a package manager or `n
 
 Dependency installation and `npm run init` require consent. The init skill uses the declared dependencies; Composer's install hook already runs npm. Sibling dependency checkouts are maintainer work. After file changes, refresh the local graph with `graphify update .`.
 
-Cleanup removes the Copilot-specific files under `.github` (`copilot-instructions.md`, `prompts/`, `instructions/`); issue templates, the PR template, `dependabot.yml`, `release.yml`, and workflows stay. `sync-ai` restores only generated framework instructions. The Claude skills remain. Review these removals before personalizing a clone.
+Cleanup removes the Copilot-specific files under `.github` (`copilot-instructions.md`, `prompts/`, `instructions/`) and the starter's own repository files (`.gitattributes`, `CODEOWNERS`, the bug and feature issue forms and their `config.yml`, `labels.yml`, `SECURITY.md`); the `task` and `epic` issue templates, the PR template, `dependabot.yml`, and workflows stay. `sync-ai` restores only generated framework instructions. The Claude skills remain. Review these removals before personalizing a clone.

.gitattributes

@@ -0,0 +1,15 @@
+# Starter-only files: theme-elementary's own repository settings, which must
+# not reach a theme created from the starter. `composer create-project`
+# installs the Packagist dist archive, and export-ignore leaves these out of
+# it. For a git clone, `npm run init` removes the same files (cleanup.targets
+# in bin/scaffold.config.js); keep the two lists in step.
+/.gitattributes                     export-ignore
+/.github/CODEOWNERS                 export-ignore
+/.github/ISSUE_TEMPLATE/bug.yml     export-ignore
+/.github/ISSUE_TEMPLATE/config.yml  export-ignore
+/.github/ISSUE_TEMPLATE/feature.yml export-ignore
+/.github/labels.yml                 export-ignore
+/SECURITY.md                        export-ignore
+/.github/release-starter            export-ignore
+/.github/workflows/release-starter.yml export-ignore
+/tests/js/starter-files.test.js     export-ignore

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @aryanjasala @AnuragVasanwala @Adi-ty

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,128 @@
+name: Bug report
+description: Something in the theme-elementary starter is broken or behaves unexpectedly.
+type: Bug
+labels:
+  - "Type: Bug"
+body:
+  - type: markdown
+    attributes:
+      value: >-
+        Thanks for reporting a bug. Please search
+        [existing issues](https://github.com/rtCamp/theme-elementary/issues?q=is%3Aissue)
+        first. Bugs in the framework belong in
+        [wp-primitives](https://github.com/rtCamp/wp-primitives/issues), and
+        bugs in `npm run init` or `npx wp-tooling` in
+        [wp-tooling](https://github.com/rtCamp/wp-tooling/issues).
+  - type: markdown
+    attributes:
+      value: >-
+        **Found a security issue?** Do not open a public issue. Report it
+        privately through
+        [GitHub's vulnerability reporting](https://github.com/rtCamp/theme-elementary/security/advisories/new),
+        as [SECURITY.md](https://github.com/rtCamp/theme-elementary/blob/main/SECURITY.md)
+        describes.
+  - type: input
+    id: starter-version
+    attributes:
+      label: Starter version or commit
+      description: >-
+        The release you started from (`composer create-project` prints it) or,
+        if you cloned `main`, the commit SHA.
+      placeholder: 2.0.0, or a1b2c3d
+    validations:
+      required: true
+  - type: dropdown
+    id: where
+    attributes:
+      label: Where does it happen?
+      options:
+        - In the starter itself, before `npm run init`
+        - In a theme created from the starter, after `npm run init`
+        - During `composer create-project` or `npm run init`
+    validations:
+      required: true
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - "Init and setup (npm run init, bin/scaffold.config.js)"
+        - "Templates, parts, patterns and theme.json"
+        - "Assets and build (src/, blocks, webpack, HMR, Tailwind)"
+        - "PHP (inc/ and its wp-primitives wiring)"
+        - "Tests and lint (PHPUnit, Jest, PHPCS, PHPStan, ESLint, Stylelint)"
+        - "CI workflows"
+        - Documentation
+        - Not sure
+    validations:
+      required: false
+  - type: input
+    id: wp-version
+    attributes:
+      label: WordPress version
+      placeholder: "6.8"
+    validations:
+      required: true
+  - type: input
+    id: php-version
+    attributes:
+      label: PHP version
+      placeholder: "8.3"
+    validations:
+      required: true
+  - type: input
+    id: node-version
+    attributes:
+      label: Node version
+      description: The output of `node --version`. The starter expects the version in `.nvmrc`.
+      placeholder: v22.22.2
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Local environment
+      description: Where WordPress runs, if relevant.
+      placeholder: wp-env, VIP dev-env, Local, a remote host
+    validations:
+      required: false
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: The error or behaviour you saw. Screenshots help for front-end and editor bugs.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What did you expect to happen?
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. composer create-project rtcamp/theme-elementary demo
+        2. cd demo && npm run init -- --name="Demo" --yes
+        3. ...
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant log output
+      description: Terminal output, PHP errors or browser console errors. Rendered as code, so no backticks are needed.
+      render: shell
+    validations:
+      required: false
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Before you submit
+      options:
+        - label: I searched the existing issues and this is not a duplicate.
+          required: true
+        - label: I removed secrets, keys and private URLs from everything above.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/rtCamp/theme-elementary/security/advisories/new
+    about: Report security issues privately, never in a public issue. See SECURITY.md.

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,69 @@
+name: Feature request
+description: Suggest something the theme-elementary starter should include or do.
+type: Feature
+labels:
+  - "Type: Feature"
+body:
+  - type: markdown
+    attributes:
+      value: >-
+        Thanks for the suggestion. Please search
+        [existing issues](https://github.com/rtCamp/theme-elementary/issues?q=is%3Aissue)
+        first.
+  - type: markdown
+    attributes:
+      value: >-
+        Every theme created from this starter copies it, so additions should be
+        general enough for most projects. Framework behaviour belongs in
+        [wp-primitives](https://github.com/rtCamp/wp-primitives), the init and
+        scaffold engine in [wp-tooling](https://github.com/rtCamp/wp-tooling),
+        and CI jobs in
+        [wp-shared-workflows](https://github.com/rtCamp/wp-shared-workflows).
+        [CONTRIBUTING.md](https://github.com/rtCamp/theme-elementary/blob/main/CONTRIBUTING.md)
+        explains how to build it yourself.
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - "Init and setup (npm run init, bin/scaffold.config.js)"
+        - "Templates, parts, patterns and theme.json"
+        - "Assets and build (src/, blocks, webpack, HMR, Tailwind)"
+        - "PHP (inc/ and its wp-primitives wiring)"
+        - "Tests and lint (PHPUnit, Jest, PHPCS, PHPStan, ESLint, Stylelint)"
+        - "CI workflows"
+        - "AI tooling (AGENTS.md, Claude skills, Copilot prompts)"
+        - Documentation
+        - Not sure
+    validations:
+      required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem does this solve?
+      description: What you are building on the starter, and what stops you today.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed change
+      description: >-
+        What the starter should ship, and whether it should be always on, an
+        example set that init can remove, or an optional feature.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Workarounds you use now, or other designs you ruled out.
+    validations:
+      required: false
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Before you submit
+      options:
+        - label: I searched the existing issues and this is not a duplicate.
+          required: true