ci: run format:check and add SECURITY.md + issue/PR templates

[Mona-i]

Description

The repo defines a format:check script (package.json L17) but CI (.github/workflows/ci.yml) only runs lint, typecheck, and build — never format:check. So Prettier drift can reach main. Additionally, there are no issue/PR templates or SECURITY.md in .github/ (only workflows/).

This issue bundles the small repo-hygiene gaps.

Scope

• Add a Format check step to CI running pnpm format:check (ensure the tree passes; run pnpm format if needed).
• Add .github/ISSUE_TEMPLATE/ (bug + feature) and PULL_REQUEST_TEMPLATE.md whose checklist references the real gates (pnpm lint, pnpm typecheck, pnpm build, and the sibling-lumio-sdk build prerequisite from CONTRIBUTING.md).
• Add a short SECURITY.md (no invented contacts; placeholder or GitHub private reporting).

Out of scope

• Changing Prettier/ESLint rules.

Acceptance criteria

• CI fails on unformatted code, passes on the current tree.
• New issues/PRs get templates referencing the real workflow.
• SECURITY.md renders in the Security tab with no fabricated details.

Where to start

• .github/workflows/ci.yml, package.json:17, CONTRIBUTING.md.

Estimated effort: ~2–3h. Good first issue.