docs: add org community health defaults

[AlbinoGeek]

Summary

Adds organization-default community health files so repos without their own still show a complete Community health panel:

• SECURITY.md — private disclosure via GitHub advisories or oss@rethunk.ai
• SUPPORT.md — issues / discord-docs / OSS email routing
• CONTRIBUTING.md — Conventional Commits + PR expectations (defers to repo-specific docs)
• CODE_OF_CONDUCT.md — Contributor Covenant 2.1, enforcement via oss@rethunk.ai
• README.md — describes this .github templates repo (mirrors Rethunk-Tech’s pattern)

Tone matches existing first-party docs (e.g. bakeoff’s SECURITY/CONTRIBUTING): short, explicit scope, no fluff.

Notes

• Repo-level files still win when present (bakeoff keeps its own SECURITY/CONTRIBUTING).
• Did not add FUNDING.yml or org-wide issue/PR templates yet — happy to follow up if you want those.

Test plan

• Merge and check https://github.com/Rethunk-AI/.github (files at repo root)
• Spot-check a public repo without its own SECURITY (e.g. discord-docs or bakeoff-results) for inherited Community health links

[Copilot]

🔵 Needs a closer look

Inherited policies contain links and branch/path assumptions that may direct users to incorrect or nonexistent resources.

Pull request overview

Adds organization-wide default GitHub Community Health files for repositories without repository-specific policies.

Changes:

• Adds security disclosure and support guidance.
• Adds contribution expectations and Contributor Covenant 2.1.
• Documents the .github templates repository.

File summaries

File	Summary	Review notes
SUPPORT.md	Support and contact routing	Security reference should target the repository’s effective policy.
SECURITY.md	Vulnerability disclosure policy	Avoid hard-coded main and the literal <repo> path; direct reporters to the repository’s Security tab.
README.md	Repository and template overview	No review comments.
CONTRIBUTING.md	Contribution and PR expectations	Use repository-neutral policy references and avoid assuming main as the default branch.
CODE_OF_CONDUCT.md	Community standards and enforcement	No review comments.

Review details

Suppressed comments (7)

CONTRIBUTING.md:9

• Because this is an organization default, GitHub resolves this relative link against the .github repository. A repository can inherit this CONTRIBUTING.md while defining its own code of conduct, so contributors may be sent to the org policy instead of the repository's effective policy; use repository-neutral wording here.

- Be respectful — see [`CODE_OF_CONDUCT.md`](CODE_OF_CONDUCT.md).

CONTRIBUTING.md:34

• This relative link has the same default-file resolution problem: a repository may inherit this CONTRIBUTING.md while defining its own SECURITY.md, but the link points to the org .github policy. Refer to the repository's effective Security policy without linking to a fixed relative path.

Report vulnerabilities privately — see [`SECURITY.md`](SECURITY.md).

CONTRIBUTING.md:39

• This relative link is also resolved from the .github repository, so it can bypass a repository-specific SUPPORT.md when this default CONTRIBUTING.md is inherited. Use repository-neutral wording rather than linking to the org default.

- Org / process: [oss@rethunk.ai](mailto:oss@rethunk.ai) or see [`SUPPORT.md`](SUPPORT.md)

CONTRIBUTING.md:27

• This inherited contribution guide is intended for repositories with different default branch names, so the main parenthetical can direct contributors to a nonexistent or non-default branch. Keep the instruction generic and let each repository's default branch determine where to branch from.

1. Branch from the repository default branch (`main` unless noted).

SECURITY.md:16

• The literal <repo> placeholder makes this instruction fail when copied directly: it is not a link, and the literal path returns 404. Since one organization default cannot hard-code the affected repository, direct reporters to that repository's Security tab instead.

   `https://github.com/Rethunk-AI/<repo>/security/advisories/new`

SECURITY.md:8

• Because this is an organization-wide default, hard-coding main makes the policy inaccurate for any repository whose default branch is named master, trunk, or something else, despite the preceding reference to the default branch. Refer to the repository's default branch without naming a specific branch.

Unless a repo says otherwise, only the default branch (`main`) is supported.

SUPPORT.md:11

• Because this is an organization default, GitHub resolves this relative link against the .github repository. A repository can inherit this SUPPORT.md while defining its own SECURITY.md, so the link sends reporters to the org default instead of the repository's effective policy; use repository-neutral wording or a target-repository Security URL.

| Security vulnerability | See [`SECURITY.md`](SECURITY.md) — do **not** file a public issue |

• Files reviewed: 5/5 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.