docs: add CONTRIBUTING.md

[andresdefi]

Summary

Adds a CONTRIBUTING.md so new contributors have a single place to learn the architectural rules that aren't obvious from the code alone, plus the practical process for getting a PR landed.

What's in it

• What appframe is / isn't - positioning + a short list of out-of-scope work to filter incoming PRs.
• Issues vs PRs - nudges contributors toward shipping a PR rather than throwing requests over the wall. Reflects the practical maintainer-load reality.
• Quick start + the rebuild / hard-refresh gotchas that anyone running the preview hits day one.
• Project structure - 3 packages explained in 3 lines each.
• The non-negotiables - 6 load-bearing architecture invariants (rich-envelope vs slim config, hydrate-not-init, atomic writes, slim persistence, no magic slug, no fallbacks for impossible states). Each anchored to a past incident or design decision documented in CLAUDE.md.
• Code conventions - TS strict, ESM, no emojis, no em dashes, the comment philosophy.
• UI / UX bar - including the requirement that any user-facing change must include screenshots, with screen recordings recommended for flow-based features.
• MCP contributions - the 5 rules from CLAUDE.md (cover UI surface, discoverable IDs, merge-not-replace, descriptions name units, smoke-test end-to-end).
• Testing, PR process, security reporting, recognition - short and practical.

Test plan

• Markdown renders cleanly
• Links resolve (CLAUDE.md, security advisories tab)
• No em dashes, no emojis

🤖 Generated with Claude Code