chore: adopt engineering standard v1.0.0

Adopt the org engineering standard (its-consulting/standards @ v1.0.0).

Adds baseline governance/CI/policy files rendered from the standard's
templates and pins .standards-version=1.0.0. Vendored OPA/Rego policies
under .standards/policies/ so CI runs the gate locally (no cross-repo dep).
Placeholders ({{ORG}}/{{REPO}}/{{OWNER_HANDLE}}/{{MAINTAINER_EMAIL}}) filled in.
Existing files that differ were left untouched by the adopter.

Automated rollout. Files created: 15.

CONTRIBUTING.md

@@ -0,0 +1,82 @@
+# Contributing to `Testapp`
+
+> Rendered by `adopt-standard.sh` from the standards repo, pinned at
+> **`1.0.0`** (see [`.standards-version`](.standards-version)).
+> Replace the `{{PLACEHOLDERS}}` and tailor as needed. This is the adopter-facing
+> variant of the standard's own contribution guide.
+
+This repo adopts our engineering standard. Contributions follow it: **decisions are
+recorded, the local gate must pass, and an owner reviews via CODEOWNERS.**
+
+---
+
+## TL;DR
+
+1. **Branch** off `develop` with a short-lived `feature/<topic>` branch (branch &
+   merge SOP — SOP-001 in the standard).
+2. If you are **deciding** something architectural (a contract, default, or rule),
+   record an **ADR** first (`docs/adr/NNNN-kebab-title.md`, Nygard format).
+3. Make the change.
+4. Run the gate locally: **`pre-commit run -a`** and, if this repo has a `Makefile`
+   with a test target, **`make test`**. Both must pass.
+5. Add a `CHANGELOG.md` entry under `[Unreleased]`.
+6. Commit with **Conventional Commits**, open a PR, fill the PR template, get an
+   **owner review** ([`CODEOWNERS`](CODEOWNERS)).
+
+---
+
+## The local gate
+
+CI runs the same checks; passing locally is the contract for opening a PR.
+
+```bash
+pre-commit install      # one-time
+pre-commit run -a       # hygiene + shellcheck + gitleaks + sops-encrypted-check (+ optional conftest)
+make test               # if this repo defines it (validate/test/policy targets)
+```
+
+Tooling degrades gracefully: an optional binary that is not installed is skipped with
+a notice rather than hard-failing — but install it if your change touches the area it
+checks. **Never bypass `gitleaks` or `sops-encrypted-check`** (see
+[`SECURITY.md`](SECURITY.md): no plaintext secrets, ever).
+
+---
+
+## Conventional Commits
+
+```
+<type>(<optional scope>): <imperative summary>
+```
+
+Allowed `type`s: `feat`, `fix`, `docs`, `ci`, `refactor`, `test`, `chore` (plus
+`adr`, `sop`, `policy` for standard-adjacent repos). Use `!` or a `BREAKING CHANGE:`
+footer for changes consumers must act on. Examples:
+
+```
+feat(api): add idempotent retry to the payment client
+fix(ci): pin reusable workflow to v1.0.0
+docs: clarify staging deploy approval step
+```
+
+---
+
+## Review via CODEOWNERS
+
+Every PR requires review from an owner in [`CODEOWNERS`](CODEOWNERS) before merge
+(enforce with branch protection on `develop`/`main`). Security-relevant paths
+(`/.github/`, `/ci/`, `/policies/`, `/secrets/`, `/SECURITY.md`) always require an
+owner's sign-off. The PR template is your checklist.
+
+## CI wiring
+
+This repo's CI is a **thin caller** that `uses:` the standard's reusable workflows
+pinned at the adopted version (see [`.github/workflows/ci.yml`](.github/workflows/ci.yml)).
+Do not copy pipeline logic into this repo — change the standard and bump the pin
+instead.
+
+---
+
+## References
+
+- [`SECURITY.md`](SECURITY.md) · [`CODEOWNERS`](CODEOWNERS) · [`.standards-version`](.standards-version)
+- [`.pre-commit-config.yaml`](.pre-commit-config.yaml) · [`.github/workflows/ci.yml`](.github/workflows/ci.yml)