docs: human-readable README intro + missing governance files

[Pigbibi]

Summary

• Reorder README.md / README.zh-CN.md so the plain-language one-sentence description comes before the "QSL architecture role" field checklist (was reversed), matching the de-templating pass already merged in sibling repositories. No factual content changed.
• Add the three governance files that were completely missing from this repository: CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, styled after the already-merged BinancePlatform versions but adapted to this repo's actual role (strategy-library layer, artifact-first market signal source builder — no orders, no broker credentials, no platform runtime mutation) and its real CI verification commands (ruff check ., python -m pytest tests -q).

No code, config, or workflow logic changed.

Test plan

• Read full README.md / README.zh-CN.md before editing to confirm actual structure (no separate "## What this repository is" heading exists here, so none was added — only the existing paragraph and checklist were reordered).
• Confirmed via gh api repos/.../private-vulnerability-reporting that private vulnerability reporting is disabled, so SECURITY.md does not claim that channel exists.
• Verified local verification commands in CONTRIBUTING.md against .github/workflows/ci.yml (ruff + pytest) rather than inventing them.
• git diff reviewed — README changes are pure reordering, no wording/content changes.

🤖 Generated with Claude Code