Document issue-first pull request workflow

[itsflaid]

Summary

• require GitHub issues before PRs for bugs, reliability/security fixes, MVP work, and UX changes
• prepare and verify implementation locally before asking the maintainer to create the issue
• require linked PR bodies using Closes #N
• document explicit exceptions for small process and maintenance changes
• update private progress notes

Verification

• git diff --check
• documentation review