docs: record verified development delivery and explicit release gates

Document independent native architecture, server compatibility, build/signing procedures, privacy limitations and persistent continuation steps. Record two consecutive seven-test API 35 HTTPS/OIDC passes, portable and host-tool checks, and inspected unsigned artifacts. Explicitly withhold production readiness pending Apple SDK validation, API 37/current-device testing, real IdPs, resource-limit review, human security review and maintainer signing.

CONTRIBUTING.md

@@ -0,0 +1,27 @@
+# Contributing
+
+This is an independent mobile repository, not the upstream Yuvomi project.
+Discuss substantial changes with the community maintainer before submitting a PR.
+Do not open upstream issues or submit upstream patches on somebody else's behalf.
+
+Use `feat/`, `fix/`, or `docs/` branches and Conventional Commits. Keep commits
+reviewable and scoped. Preserve existing work. Run the relevant tests, lint,
+`python3 scripts/check-repository.py`, and `git diff --check` before committing.
+Add regression tests with security fixes, and demonstrate that the test fails
+without the fix. Do not commit build outputs, credentials, private signing keys,
+local servers, generated fixture certificates, or production household data.
+
+Keep platform integrations native and dependencies minimal. The server owns
+business logic, authentication, CSRF, and authorization. Never solve compatibility
+by disabling TLS, accepting every origin, or copying a browser's session cookies.
+Upstream prohibits frontend frameworks, bundlers, and transpilers in its own
+codebase; we make no changes to it. Read its CONTRIBUTING, SECURITY, and DESIGN
+before proposing an upstream integration.
+
+This code was drafted with OpenAI through OpenCode. Disclose AI assistance in PRs
+(one sentence is sufficient), as upstream requests. Generated code and automated
+reviews do not replace human review. No merge, release, public issue, or store
+publication happens automatically. Security-sensitive code needs human review.
+
+See `docs/build-android.md`, `docs/build-ios.md`, and `docs/validation.md`.
+The portable Swift package checks shared production policy, not the iOS app.