chore: add open-source community files and CI workflow

- LICENSE (MIT)
- SECURITY.md (vulnerability reporting policy)
- CONTRIBUTING.md (development setup and contribution guide)
- CI workflow (fmt, clippy, test on push/PR)
- Issue templates (bug report, feature request)
- Dependabot config (cargo + github-actions weekly)
- Cargo.toml workspace metadata (license, repository, description)

SECURITY.md

@@ -0,0 +1,28 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+|---------|--------------------|
+| 0.7.x   | :white_check_mark: |
+| < 0.7   | :x:                |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in wx-cli, please report it responsibly:
+
+1. **Do NOT open a public issue.**
+2. Use [GitHub Private Vulnerability Reporting](https://github.com/pandorafuture/wx-cli/security/advisories/new) to submit your report.
+3. Include steps to reproduce, affected versions, and potential impact.
+
+You should receive an acknowledgment within 48 hours. We will work with you to understand the issue and coordinate a fix before any public disclosure.
+
+## Scope
+
+wx-cli handles sensitive data including:
+
+- WeChat database encryption keys
+- Decrypted chat messages and media
+- Local keystore files
+
+Security issues in any of these areas are treated with high priority.