docs: public-facing README + contributing notes; generic CI comments

README.md

@@ -140,13 +140,21 @@ derived-key scope.
 
 Wallet + governance paths exercised on **mainnet**. DAO + escrow
 paths exercised end-to-end on **preprod**; the escrow validator has
-undergone internal review (`audits/`) but **no third-party audit**.
-Treat the escrow flows as use-at-own-risk until external review lands
-— see `aiken-escrow/README.md` for the WIP threat model.
+had a code review but **no third-party security audit**. Treat the
+escrow flows as use-at-own-risk until external review lands — see
+`aiken-escrow/README.md` for the WIP threat model.
+
+## Contributing
+
+Issues and pull requests are welcome. Before opening a PR, run
+`cargo fmt`, `cargo clippy --all-targets`, and `cargo test`. Changes
+that touch the on-chain validator (`aiken-escrow/`) or the signing
+path (`aldabra-core`) should spell out the security reasoning in the
+PR description.
 
 ## License
 
-See `LICENSE`.
+See [`LICENSE`](LICENSE).
 
 ## Dependencies of note