Contribution model: outside PRs, CONTRIBUTING.md, PR template, issue forms #4869

Part of the agentic software factory tracker #4858, Wave 3. Proposed as S8 in docs/agent-guidance-inception.md (PR #4861) §9, from #4859.

Depends on

After Part 2 (AGENTS.md). The maintainers' decision is recorded below.

Scope

• Decided (maintainers, on PR docs: agentic software factory inception (docs/agent-guidance-inception.md) #4861): outside PRs are turned off, as in the Inspector. External contributors, org members with write access included, file detailed issues (the problem, a repro, the expected behavior, and the prompt they used if they prototyped a fix, never a diff). Maintainers open every PR.
• Make these say so:
  • CONTRIBUTING.md
  • the Contributing section of AGENTS.md
  • .github/pull_request_template.md, with the Inspector's "issues, not PRs" banner
  • new issue forms in .github/ISSUE_TEMPLATE/: bug and feature forms with a server dropdown and a spec-era/client field; config.yml routing security reports to a private advisory and new servers to the Registry
• Plan how the open outside-PR backlog is handled. For example, close each one with a pointer to the issue flow, first filing an issue for any fix worth keeping. Part 8 (Add issue-triage skill and board audit, for community inflow #4868) carries the plan out in its triage pass.

Acceptance criteria

• The docs and templates state the issues-only policy.
• The backlog plan is written down for Part 8.
• The forms validate against GitHub's issue-forms schema. They only go live after the next milestone merge to main, since GitHub serves them from the default branch.

Branch

Targets v2/main. Closes #N won't auto-close an issue on a non-default branch, so close this one by hand on merge and move the card to Done.