chore: open-source readiness — devkit v2.1.6, CoC, usage docs

[omar-nahhas]

DiffVisualizer is ready to open-source. Any ```diff block in a chat becomes a side-by-side visual diff, with a fullscreen review overlay and raw-text copy.

All 10 BDD scenarios are illustrated in docs/BEHAVIOUR.md with screenshots from a passing run — including the two that matter most for trust: malformed diff text falls back to a readable code block, and a non-diff fence is left completely untouched.

---

What this PR contains

devkit → v2.1.6	hardened caller: workflow ref pinned to a release tag, secrets passed explicitly
CODE_OF_CONDUCT.md	Contributor Covenant — the last missing governance file
README → Usage	written from the behaviours the BDD suite actually asserts

The security change is the substantive one

The caller previously used @main with secrets: inherit. That reached 24 repos, not four — including agent-zero-new-plugin-template, so every future plugin inherited it.

@main is not merely "mutable": it meant every merge to the devkit went live in this repo's CI immediately and unreviewed. Three fleet-wide regressions already arrived that way — 18 sync PRs auto-closed (four already green), every consumer's e2e green while shipping zero traces, and every Dependabot PR structurally red.

secrets: inherit forwarded every repo- and org-level secret, including ones added later and ones the workflow never declares. The reusable workflow declares exactly three, all optional — so the explicit list is a strict superset of what it consumes and breaks nothing.

Rated honestly: confidentiality low (one org member, zero forks, no outside collaborators), integrity/blast-radius medium. Fixed as change management, not as a breach.

Documentation is generated, not written

docs/BEHAVIOUR.md and docs/screenshots/ are produced by make docs from this repo's own passing e2e run. Every screenshot is the asserted end state of a scenario that currently passes, so it cannot depict behaviour the plugin no longer has — and a renamed or deleted scenario drops out on regeneration. Captions are the BDD scenario titles verbatim.

The new README Usage section links to it, so a reader can check every claim against a screenshot CI produced.

Open-source readiness

check	state
secrets in tree and full git history	clean — regex + trufflehog, both engines proven against planted secrets first
workflow-run logs	clean — 162 runs scoped, 153 with readable text, 0 hits
LICENSE / CONTRIBUTING / SECURITY / CoC	complete
issue templates + private security advisory routing	present
behaviour docs with real screenshots	present
README badges	present, every one click-verifiable
caller-template drift	in sync (checked by the new DEC-080 checker)

Why this is a draft

Yours to review, not mine to merge. Two things worth your eye:

1. The Usage prose. I wrote it from the scenario titles and the existing README, so it should be accurate — but it is the one part of this PR not generated from a passing test.
2. enforce_admins: false on this repo. I have been merging past BLOCKED with --admin all session. The e2e was genuinely green each time, but if "CI green" is your gate for going public, branch protection is not currently enforcing it — I am, by choice. Worth tightening before you rely on it.