chore: open-source readiness — devkit v2.1.6, CoC, usage docs

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/agent-zero-plugins/agent-zero-plugin-diff-visualizer/security/advisories/new
+    about: Please report security issues privately, not as public issues.

.github/workflows/devkit-sync.yml

@@ -35,7 +35,7 @@ permissions:
 
 jobs:
   sync:
-    uses: agent-zero-plugins/agent-zero-plugin-development-testkit/.github/workflows/devkit-sync.yml@main
+    uses: agent-zero-plugins/agent-zero-plugin-development-testkit/.github/workflows/devkit-sync.yml@v2.1.6
     with:
       devkit-submodule-path: "tests/_testkit"
     secrets:

.github/workflows/plugin-e2e.yml

@@ -8,9 +8,19 @@
 # (.devkit.yml `plugin_dir` → else canonical usr/plugins/<name>), so this
 # template is identical across all repos.
 #
-# Needs the shared sync-App secrets to clone the private devkit submodule, and
-# (DEC-055) GHCR_PULL_TOKEN to pull the private fork image. `secrets: inherit`
-# forwards all repo secrets, so new shared secrets need no caller change.
+# Needs (DEC-055) GHCR_PULL_TOKEN to pull the private fork image; the sync-App
+# pair is legacy/optional since the devkit went public (DEC-075).
+#
+# SECRETS ARE PASSED EXPLICITLY, not via `secrets: inherit` (DEC-081).
+# `inherit` forwards EVERY repo- and org-level secret to the reusable workflow —
+# including secrets added later and secrets the workflow never declares. The
+# reusable workflow declares exactly the three below, all `required: false`, so
+# this list is complete. Adding a shared secret later means editing this template
+# and re-running `make link-workflows`, which is the same cadence as every other
+# devkit asset (devkit-sync.caller.yml already pays exactly this cost).
+#
+# The `uses:` ref is pinned to a RELEASE TAG, not `@main`. With `@main`, every
+# merge to the devkit went live in 24 consumers' CI immediately and unreviewed.
 name: plugin-e2e
 
 on:
@@ -30,7 +40,10 @@ permissions:
 
 jobs:
   e2e:
-    uses: agent-zero-plugins/agent-zero-plugin-development-testkit/.github/workflows/plugin-e2e.yml@main
-    secrets: inherit
+    uses: agent-zero-plugins/agent-zero-plugin-development-testkit/.github/workflows/plugin-e2e.yml@v2.1.6
+    secrets:
+      GHCR_PULL_TOKEN: ${{ secrets.GHCR_PULL_TOKEN }}
+      SKILLS_SYNC_APP_CLIENT_ID: ${{ secrets.SKILLS_SYNC_APP_CLIENT_ID }}
+      SKILLS_SYNC_APP_PRIVATE_KEY: ${{ secrets.SKILLS_SYNC_APP_PRIVATE_KEY }}
     with:
       capture-all-traces: ${{ inputs.capture_all_traces || false }}

CODE_OF_CONDUCT.md

@@ -0,0 +1,87 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the overall
+  community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or advances of
+  any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement by opening a
+report via the repository's
+[private vulnerability reporting form](https://github.com/agent-zero-plugins/agent-zero-plugin-development-testkit/security/advisories/new)
+(also used for conduct reports) or by contacting the repository maintainers.
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+1. **Correction** — private, written warning, with clarity around the violation.
+2. **Warning** — a warning with consequences for continued behavior.
+3. **Temporary Ban** — temporary ban from any sort of interaction or public
+   communication with the community.
+4. **Permanent Ban** — permanent ban from any sort of public interaction within
+   the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
+
+[homepage]: https://www.contributor-covenant.org
+[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html

README.md

@@ -60,6 +60,44 @@ flowchart TD
     D[(diff2html 3.4.51\njsDelivr CDN, lazy + memoised)] --> R
 ```
 
+## Usage
+
+Every behaviour below is covered by a BDD scenario in [`tests/e2e/features/`](tests/e2e/features/),
+and [`docs/BEHAVIOUR.md`](docs/BEHAVIOUR.md) shows each one as a screenshot captured from a passing
+run — so what you read here is what CI proves on every push.
+
+### Nothing to drive
+
+There is no button to press and no mode to switch on. Whenever a message contains a fenced
+` ```diff ` block, it is replaced in place with a side-by-side visual diff. Ask the agent for a diff,
+paste one in yourself, or have a tool emit one — it renders either way.
+
+Multi-file diffs render as one visual diff containing both files, so a patch that touches several
+files reads as a single reviewable unit rather than fragments.
+
+### Reviewing a large diff
+
+Hover a rendered diff for its toolbar:
+
+- **Maximize** opens a single fullscreen overlay for reading a long patch without the chat column
+  squeezing it. Close it with the ✕, a backdrop click, or **Escape** — all three are asserted, and so
+  is the fact that the inline diff survives the overlay closing.
+- **Copy** puts the **raw diff text** on the clipboard, not the rendered HTML. You can paste it
+  straight into `git apply`.
+
+### When the input is not a clean diff
+
+Two failure modes are handled deliberately, because silently mangling text is worse than not
+rendering it:
+
+- **Malformed diff text** falls back to the readable plain code block. You still see the content.
+- **A non-diff code fence is left completely untouched.** A ` ```python ` block stays a Python block.
+  The plugin only claims fences it can actually render.
+
+Both are asserted scenarios rather than intentions.
+
+---
+
 ## Install
 
 **Plugin Hub (recommended):** open *Settings → Plugins* in Agent Zero, find