CONTRIBUTING + PR template (www)

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,2 @@
+We don't take code contributions right now — see [CONTRIBUTING.md](../CONTRIBUTING.md).
+Spotted a wrong or misleading claim, a typo, or a security issue? File an issue (or a private vulnerability report) and we'll act on it — credited.

CONTRIBUTING.md

@@ -0,0 +1,19 @@
+# Contributing
+
+This repository is the fosterstack.com website, and the same contribution
+model as [fosterstack/cache](https://github.com/fosterstack/cache/blob/main/CONTRIBUTING.md)
+applies: **we don't take code contributions right now.** Not a judgment of
+anyone's work — the implementation here is done by AI agents under automated
+gates, and an outside diff is the one input that can't go through those
+gates unreviewed.
+
+What we want, and will act on:
+
+- **Issues** — a typo, a claim that reads wrong, a page that misled you, an
+  accessibility problem. Copy corrections move fastest of all.
+- **Security reports** for anything on the site, through GitHub's private
+  vulnerability reporting. Send the report, not the patch; you'll be
+  credited in the fix.
+
+Pull requests stay enabled for our own tooling; an outside PR gets a
+friendly close with a link here and its substance re-filed as an issue.

bin/check-file-allowlist.sh

@@ -11,6 +11,8 @@
 set -euo pipefail
 
 ALLOW_PATTERNS=(
+  '^CONTRIBUTING\.md$'
+  '^\.github/PULL_REQUEST_TEMPLATE\.md$'
   '^index\.html$'
   '^README\.md$'
   '^LICENSE$'