chore: adopt engineering standard v1.0.0

Adopt the org engineering standard (its-consulting/standards @ v1.0.0).

Adds baseline governance/CI/policy files rendered from the standard's
templates and pins .standards-version=1.0.0. Vendored OPA/Rego policies
under .standards/policies/ so CI runs the gate locally (no cross-repo dep).
Placeholders ({{ORG}}/{{REPO}}/{{OWNER_HANDLE}}/{{MAINTAINER_EMAIL}}) filled in.
Existing files that differ were left untouched by the adopter.

Automated rollout. Files created: 15.

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,52 @@
+---
+name: Bug report
+about: Report something that is broken or behaves incorrectly
+title: "bug: <short summary>"
+labels: [bug, triage]
+assignees: []
+---
+
+<!--
+Rendered into <repo>/.github/ISSUE_TEMPLATE/ by adopt-standard.sh.
+SECURITY: do NOT paste secrets, private keys, tokens, or production hostnames.
+If this is a security vulnerability, do NOT file a public issue — see SECURITY.md.
+-->
+
+## Summary
+
+<!-- One sentence: what is wrong? -->
+
+## Steps to reproduce
+
+1.
+2.
+3.
+
+## Expected behaviour
+
+<!-- What you expected to happen. -->
+
+## Actual behaviour
+
+<!-- What actually happened. Include error output (redact any secrets). -->
+
+```text
+
+```
+
+## Environment
+
+- Repo version / commit:
+- Adopted standard version (`.standards-version`):
+- OS / runtime:
+- CI or local:
+
+## Impact
+
+- [ ] Blocks work / production
+- [ ] Workaround exists
+- [ ] Cosmetic / minor
+
+## Additional context
+
+<!-- Links, screenshots (no secrets), related issues. -->

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,13 @@
+# Issue chooser config — rendered into <repo>/.github/ISSUE_TEMPLATE/ by
+# adopt-standard.sh. Disables blank issues so every report uses a template,
+# and routes security reports away from the public tracker.
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability (private)
+    url: https://github.com/its-consulting/REISE-TEST/security/advisories/new
+    about: >-
+      Do NOT open a public issue for a security problem. Report privately per
+      SECURITY.md (no secrets/keys/tokens in the report; rotate first if leaked).
+  - name: Question / discussion
+    url: https://github.com/its-consulting/REISE-TEST/discussions
+    about: For usage questions and open-ended discussion, use Discussions.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,37 @@
+---
+name: Feature request
+about: Propose new functionality or a change to existing behaviour
+title: "feat: <short summary>"
+labels: [enhancement, triage]
+assignees: []
+---
+
+<!--
+Rendered into <repo>/.github/ISSUE_TEMPLATE/ by adopt-standard.sh.
+If this proposes a change to a rule, contract, or default, expect to record an ADR
+(docs/adr/NNNN-*.md) before it is implemented — see CONTRIBUTING.md.
+-->
+
+## Problem / motivation
+
+<!-- What problem does this solve? Who feels the pain, and when? -->
+
+## Proposed solution
+
+<!-- What you'd like to happen. Be concrete. -->
+
+## Alternatives considered
+
+<!-- Other approaches and why they are worse/better. -->
+
+## Scope & impact
+
+- [ ] Backward compatible (`MINOR`)
+- [ ] Breaking — consumers must act (`MAJOR`)
+- [ ] Needs an **ADR** (decision about a rule/contract/default)
+- [ ] Needs an **SOP** and/or **Policy** change
+- [ ] Affects CI / deploy / secrets handling
+
+## Additional context
+
+<!-- Links, prior art, related issues/ADRs. -->

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,44 @@
+<!--
+PULL_REQUEST_TEMPLATE.md — rendered into <repo>/.github/ by adopt-standard.sh.
+The checklist is tied to SOP-001 (branch & merge) and the CI policy gates.
+Keep the items; tailor wording to your repo. Delete inapplicable sections, not checks.
+-->
+
+## What & why
+
+<!-- One or two sentences: what does this change do, and why now? Link the issue. -->
+
+Closes #
+
+## Type of change
+
+- [ ] `feat` — new functionality
+- [ ] `fix` — bug fix
+- [ ] `docs` — documentation only
+- [ ] `ci` / `refactor` / `test` / `chore`
+- [ ] **Breaking change** (consumers must act — `!` / `BREAKING CHANGE:` in the commit)
+- [ ] **Decision** — an ADR is included or updated (`docs/adr/NNNN-*.md`)
+
+## SOP-001 (branch & merge) checklist
+
+- [ ] Branched from `develop` with a short-lived `feature/<topic>` (no direct commits to `main`/`develop`).
+- [ ] Commits follow **Conventional Commits**.
+- [ ] Up to date with the base branch (rebased/merged); no merge conflicts.
+- [ ] At least one **CODEOWNERS** reviewer is requested.
+- [ ] `CHANGELOG.md` updated under `[Unreleased]` (if user-facing).
+
+## Policy & security gates (must be green)
+
+- [ ] `pre-commit run -a` passes locally (whitespace/EOF/YAML, **shellcheck**, **gitleaks**, **sops-encrypted-check**).
+- [ ] CI `static-checks`, `test`, `build`, **`policy_check`** and **`security-scan`** stages pass.
+- [ ] **No plaintext secrets** added — secrets are SOPS+age encrypted (`*.enc.*` / `*.sops.*` only). See `SECURITY.md`.
+- [ ] Data traffic-light respected: nothing 🔴 RED (sensitive personal data / plaintext keys) committed.
+- [ ] If this asserts a rule: an ADR records *why*, an SOP records *how*, and a Policy (+ `*_test.rego`) enforces it.
+
+## How was this verified?
+
+<!-- Commands run, environments tested, evidence. Be concrete and falsifiable. -->
+
+## Rollback plan
+
+<!-- If this is a risky change (deploy, migration, policy tightening): how to revert. -->

.github/workflows/ci.yml

@@ -0,0 +1,44 @@
+# ci.yml — self-contained standards gate (VENDORED model).
+#
+# Rendered verbatim into <repo>/.github/workflows/ by adopt-standard.sh. The
+# standard's Rego policies are vendored into this repo at .standards/policies/
+# (also placed by adopt-standard.sh, pinned to .standards-version), and the gate
+# logic lives in .standards/policy-gate.sh. CI installs conftest and runs the
+# policies LOCALLY — no dependency on a remote (possibly private) standards repo,
+# no cross-account reusable-workflow access, no PAT. Re-run adopt-standard.sh to
+# update the vendored policies when you bump the pin.
+#
+# The same gate runs identically on Forgejo/Woodpecker — see the standard's
+# ci/woodpecker/ (ADR-0002 dual-target CI). Add repo-native jobs (lint/test/build)
+# below the gate; those are language-specific and owned by the repo.
+name: ci
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  standards-gate:
+    runs-on: ubuntu-latest
+    env:
+      CONFTEST_VERSION: "0.68.2"
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install conftest (pinned)
+        run: |
+          set -euo pipefail
+          url="https://github.com/open-policy-agent/conftest/releases/download/v${CONFTEST_VERSION}/conftest_${CONFTEST_VERSION}_Linux_x86_64.tar.gz"
+          curl -fsSL "$url" | sudo tar -xz -C /usr/local/bin conftest
+          conftest --version
+
+      - name: Policy gate (vendored standards policies)
+        run: bash .standards/policy-gate.sh