The repository's own .github, now that it is public

SPEC 2.2a says INBUXA writes its own when the repository is first published,
and it is. Until now the public repository carried Stalwart's: a security
policy telling people to report vulnerabilities to Stalwart Labs, and a
contributing guide whose policy is that pull requests from anyone not on
upstream's vouched list are closed automatically. Neither is this project's,
and both were being offered to anyone who looked.

So: a security policy that says where to send a report, and what happens if
it turns out to be upstream's bug rather than ours; a contributing guide that
says what a fork of someone else's code needs from a contributor, including
the clean-room question, since the record has to stay true; the Contributor
Covenant; and a sponsor link. Upstream's two security documents move to
.github-upstream/ beside its workflows -- kept, not used, not presented as
ours.

CI builds the server and compiles every test target, and deliberately runs
no suite. The unit tests only build with the integration crate in the graph,
and the integration suites want a STORE, fixed ports and a container apiece,
so running them here would mean a tick that skipped everything or a cross
that means "the runner has no Redis". The workflow says as much, so nobody
has to rediscover it.

Also ignores /artifact: two hand-built binaries, ~190 MB, one `git add -A`
away from a public repository.

.github/FUNDING.yml

@@ -0,0 +1,4 @@
+# Funding platforms shown behind the repository's Sponsor button.
+# https://docs.github.com/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository
+
+github: jcoffey-dev

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,43 @@
+<!--
+  Thanks for contributing to INBUXA. CONTRIBUTING.md has the full guide; this
+  is the short version. Delete any section that does not apply.
+-->
+
+## Summary
+
+<!-- What changes, and why. The why is the part that is hard to recover later. -->
+
+## Related issues
+
+<!-- e.g. Closes #123. Leave blank if there are none. -->
+
+## Upstream files
+
+<!--
+  Does this touch files that came from Stalwart? If so: is the change as small
+  as it can be, and is it marked with an `inbuxa:` comment saying which
+  requirement it serves? Every edit to an upstream file is a conflict waiting
+  at the next import, so it should be worth one.
+-->
+
+## Clean room
+
+<!--
+  Only for changes to the rebuilt features in `crates/features`, or to the
+  hooks that serve them.
+
+  Confirm one:
+  - [ ] I have not read Stalwart's Enterprise-licensed source, and worked from
+        the specification in `docs/spec/features/`.
+  - [ ] I have read it. (Say so -- the change will be reviewed with that in
+        mind, or declined for the parts it touches. The project's claim of
+        independent creation is a record, and the record has to be true.)
+-->
+
+## Testing
+
+<!--
+  What you ran. `cargo test -p tests` covers what needs nothing but a store;
+  say so if you ran any of the `#[ignore]`d suites from
+  docs/spec/container-tests.md, and which.
+-->

.github/dependabot.yml

@@ -0,0 +1,42 @@
+version: 2
+updates:
+  # Cargo. One entry: the workspace has a single lockfile at the root, and
+  # ~30 manifests that upstream bumps on every release -- pointing entries at
+  # individual crates would find manifests with no lockfile beside them.
+  #
+  # Minor and patch arrive as one pull request a week. Majors are left out of
+  # the group on purpose: they are migrations rather than bumps, and each one
+  # deserves its own pull request and its own CI run.
+  - package-ecosystem: cargo
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: tuesday
+      time: "09:00"
+      timezone: Etc/UTC
+    open-pull-requests-limit: 5
+    groups:
+      minor-and-patch:
+        update-types:
+          - minor
+          - patch
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: tuesday
+      time: "09:00"
+      timezone: Etc/UTC
+    groups:
+      actions:
+        patterns:
+          - "*"
+  # The Dockerfiles pin their base images, so this is what keeps a published
+  # image off a stale base between releases.
+  - package-ecosystem: docker
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: tuesday
+      time: "09:00"
+      timezone: Etc/UTC

.github/workflows/ci.yml

@@ -0,0 +1,51 @@
+# What CI can check without a mail server's worth of infrastructure.
+#
+# The build, and that every test target compiles. It deliberately does not
+# *run* the test suites: the unit tests only build with the integration crate
+# in the graph, because that is what switches on the `test_mode` features they
+# rely on (docs/spec/SPEC.md 2.2b), and the integration suites need a `STORE`,
+# fixed ports, and in most cases a container apiece (docs/spec/
+# container-tests.md). Running them here would mean either a green tick that
+# skipped everything, or a red one that means "the runner has no Redis".
+#
+# So this catches what it can honestly catch -- code that does not compile,
+# including test code -- and the suites are run by hand, one at a time, as
+# that page describes. If that changes, it changes because someone made the
+# suites runnable unattended, not because CI started ignoring failures.
+name: CI
+on:
+  push:
+    branches: [main]
+  pull_request:
+  # Lets CI be run by hand against any ref, including one that predates a CI
+  # change, without pushing an empty commit to move it.
+  workflow_dispatch:
+
+# A second push to a branch cancels the run still going for the first: the
+# older run's answer is about code nobody is looking at any more.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      # Every `uses:` here is pinned to a full commit SHA, with the release it
+      # belongs to in the trailing comment. A tag is a mutable pointer, so
+      # trusting `@v7` is trusting every future version of that action,
+      # including one pushed by whoever compromises the account. Dependabot
+      # updates both halves together -- do not "simplify" a pin back to a tag.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2.9.2
+      - name: System dependencies
+        # foundationdb and the search backends are off by default, but the
+        # default feature set still links against the system's C libraries.
+        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends clang
+      - name: Build the server
+        run: cargo build -p inbuxa --locked
+      - name: Compile every test target
+        # `--no-run` is the point: it builds the unit tests and the integration
+        # crate together, which is the combination that resolves the test
+        # features, and stops short of running anything that wants a store.
+        run: cargo test --workspace --locked --no-run