docs: add community-health files and README badges

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @pelotech/maintainers

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,23 @@
+---
+name: Bug report
+about: Report a problem with the module
+labels: bug
+---
+
+**What happened**
+
+**What you expected**
+
+**Reproduction** — the module block / inputs (redact any secrets):
+
+```hcl
+
+```
+
+**Versions**
+
+- orgkit:
+- Terraform:
+- integrations/github provider:
+
+**Plan/apply output** (redacted)

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: false

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,13 @@
+---
+name: Feature request
+about: Suggest a capability (see the roadmap in docs/DESIGN.md)
+labels: enhancement
+---
+
+**Problem / use case**
+
+**Proposed input or resource**
+
+**Roadmap tier** — does this map to a Tier 1/2/3 item in `docs/DESIGN.md`?
+
+**Alternatives considered**

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,15 @@
+## What & why
+
+<!-- Summary of the change and the motivation. -->
+
+## Checklist
+
+- [ ] PR title follows Conventional Commits (it is linted)
+- [ ] `terraform fmt -recursive` is clean
+- [ ] `pre-commit run --all-files` passes (docs regenerated if inputs/outputs/resources changed)
+- [ ] `terraform test` passes for any submodule I changed
+- [ ] Breaking input changes are described below (pre-1.0)
+
+## Breaking changes
+
+<!-- None, or describe the migration for consumers. -->

CONTRIBUTING.md

@@ -0,0 +1,38 @@
+# Contributing
+
+Thanks for contributing to **terraform-github-orgkit**!
+
+## Development workflow
+
+- Work on a feature branch — never commit directly to `main`.
+- Use [Conventional Commits](https://www.conventionalcommits.org/). PR titles are
+  linted, and `release-please` derives the changelog and version from them.
+- Before opening a PR:
+
+  ```sh
+  terraform fmt -recursive
+  pre-commit run --all-files
+  # run tests for any submodule you touched
+  cd modules/<name> && terraform init && terraform test
+  ```
+
+- When you change inputs, outputs, or resources, the `terraform_docs` pre-commit
+  hook regenerates each README — commit the result.
+
+## Testing
+
+Tests use `terraform test` with a mocked provider (`command = plan`), so they need
+**no GitHub credentials**. Add coverage for new validations and behavior; keep test
+output pristine (warnings are treated as failures).
+
+## Design & scope
+
+Read [`docs/DESIGN.md`](docs/DESIGN.md) for the architecture, the composition DAG,
+the feature roadmap, and the design principles that must not be violated — notably:
+no hardcoded organization policy, and **secrets are never decrypted here** (callers
+pass already-decrypted values).
+
+## Pre-1.0
+
+The input interface may still change between minor releases (see the README
+"Stability" section). Call out any breaking input changes in your PR description.

README.md

@@ -1,5 +1,10 @@
 # terraform-github-orgkit
 
+[![Terraform Registry](https://img.shields.io/badge/Terraform%20Registry-orgkit-844FBA?logo=terraform)](https://registry.terraform.io/modules/pelotech/orgkit/github/latest)
+[![Release](https://img.shields.io/github/v/release/pelotech/terraform-github-orgkit)](https://github.com/pelotech/terraform-github-orgkit/releases)
+[![Tests](https://github.com/pelotech/terraform-github-orgkit/actions/workflows/test.yaml/badge.svg)](https://github.com/pelotech/terraform-github-orgkit/actions/workflows/test.yaml)
+[![License](https://img.shields.io/github/license/pelotech/terraform-github-orgkit)](LICENSE)
+
 A composable Terraform module suite for managing a **whole GitHub organization** as
 code — members, teams, repositories, GitHub Actions (variables, secrets and
 environments), organization rulesets, and organization roles.

SECURITY.md

@@ -0,0 +1,20 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please report security issues **privately** via GitHub's
+[private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability)
+on this repository's **Security** tab ("Report a vulnerability"). Do not open a
+public issue for security problems.
+
+We will acknowledge your report and keep you updated on remediation.
+
+## Supported versions
+
+This module is pre-1.0; only the latest minor release receives fixes.
+
+## A note on secrets
+
+orgkit **never decrypts secrets**. Callers pass already-decrypted values via the
+`secrets` input; decryption is a consumer concern. Do not commit plaintext secrets
+to configurations that use this module — pass them from a secure source at apply time.