Repo hygiene: bring skyhook-packages to nodewright parity (automation, CI, docs)

[lockwobr]

Summary

Bring skyhook-packages up to repo-hygiene parity with the NVIDIA/nodewright operator repo. nodewright recently landed a set of issue/PR-management automation, CI hygiene workflows, and standard project docs. This repo already has the shared label scheme (labels.yml), CODEOWNERS, a PR template, issue templates, and stale.yaml, but is missing most of the automation and several standard docs.

This is the tracking epic. Each item below is a separate issue so it can be picked up and closed independently. Everything is GitHub-side or doc-only; no package scripts or build logic are touched.

Adaptation context (this is not a clean copy from nodewright)

nodewright is a Go operator with a Helm chart. skyhook-packages is a collection of shell-script packages, each a top-level directory (nvidia-setup/, kdump/, tuned/, tuning/, nvidia-tuned/, nvidia-tuning-gke/, shellscript/, copy-fail/, installer/), each with its own Dockerfile. Consequences that shape these issues:

• No go.mod, no chart/. Workflows keyed to Go modules or Helm need retargeting or do not apply.
• The component/* label scheme from the operator does not map directly; a package/* (or coarser) scheme is the open decision in the labels issue.
• Discussions is disabled on this repo, so any "ask in Discussions" link from nodewright must be dropped.

Items

Labels (prerequisite for triage + labeler):

• Add component/package + needs-triage labels to labels.yml #55 Define package/* / component/* + needs-triage (+ optional size/*) labels in labels.yml

Issue/PR automation (port of nodewright #260, split per workflow):

• Add triage workflow (auto-label and triage new issues) #56 triage.yaml (blocked by Add component/package + needs-triage labels to labels.yml #55)
• Add labeler workflow + labeler.yml (path and size PR labels) #57 labeler.yaml + .github/labeler.yml (blocked by Add component/package + needs-triage labels to labels.yml #55)
• Add welcome workflow (greet first-time contributors) #58 welcome.yaml
• Add lock-threads workflow (lock long-closed threads) #59 lock-threads.yaml
• Add inactive-pr-reminder workflow (nudge stalling PRs) #60 inactive-pr-reminder.yaml

CI hygiene workflows:

• Add commit-linting workflow (Conventional Commit PR titles) #61 commit-linting.yaml
• Add security-checkov workflow (scan Dockerfiles and workflows) #62 security-checkov.yaml (retargeted from Helm chart to the package Dockerfiles + workflows)
• Add ShellCheck linting workflow (advisory first, then gate) #69 lint-shellcheck.yaml (advisory ShellCheck over the ~60 bash scripts; drive to green, then gate). Not in nodewright; this repo is shell-heavy and had no linting.

Standard project docs:

• Add AGENTS.md / .claude/CLAUDE.md agent guidance #63 AGENTS.md / .claude/CLAUDE.md (agent guidance, packages-specific)
• Add AUTHORS file #64 AUTHORS
• Add SUPPORT.md #65 SUPPORT.md
• Add .coderabbit.yaml #66 .coderabbit.yaml
• Add ROADMAP.md (packages-specific) #67 ROADMAP.md (packages-specific)
• Add KnownIssues.md (packages-specific) #68 KnownIssues.md (packages-specific)

Intentionally excluded

These nodewright artifacts do not apply to a shell-script repo with no Go module and are left out on purpose:

• merge-gate.yaml: gates merges on Go-dependency license verification (go-licenses, go.mod/vendor path filter). There is no Go module here, so there is nothing to gate. Revisit only if a Go component is added.
• THIRD_PARTY_NOTICES.md: generated from Go module dependencies. We are not shipping vendored dependency code, so a third-party license notice would be empty. Not applicable. If bundled third-party software in the package images ever carries its own notice obligations, that is a separate, differently-sourced effort.

Source of truth

nodewright artifacts to port from live under .github/ and the repo root of NVIDIA/nodewright. Pin action uses: to the same SHAs/versions nodewright uses, and match this repo's existing SPDX license-header style (see .github/workflows/stale.yaml).