Governance: Add CODE_OF_CONDUCT.md

[evans-sam]

Problem

No code of conduct exists. OSS repos benefit from an explicit community standard, and GitHub community-health checks look for this.

Why it matters

Community norms are a prerequisite for welcoming external contributions. Also a Scorecard input (#9).

Proposed approach

Adopt the Contributor Covenant v2.1. Reference the same contact as SECURITY.md (#8). Link from the README.

Acceptance criteria

• CODE_OF_CONDUCT.md present, unmodified Contributor Covenant v2.1 with contact filled in.
• Linked from README and CONTRIBUTING.md.