chore: add GitHub migration foundation

.env.example

@@ -0,0 +1,17 @@
+# Copy this file to `.env` and fill only the keys you use.
+# `.env` is ignored by git and must not be committed.
+
+# Required only for the Gemini route.
+GEMINI_API_KEY=put_your_gemini_api_key_here
+
+# Optional Gemini settings.
+GEMINI_SOURCE_CARD_MODEL=gemini-2.5-flash-lite
+GEMINI_BASE_URL=https://generativelanguage.googleapis.com
+GEMINI_TIMEOUT=600
+GEMINI_MAX_OUTPUT_TOKENS=4096
+GEMINI_THINKING_BUDGET=0
+GEMINI_MAX_RETRIES=3
+
+# Optional local Ollama settings.
+OLLAMA_BASE_URL=http://127.0.0.1:11434
+CLEAN_MODEL=devstral-small-2:24b-instruct-2512-q4_K_M

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,52 @@
+name: Bug report
+description: Report a reproducible problem.
+title: "[Bug]: "
+labels: ["bug"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What is wrong?
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: List the exact commands or actions.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: OS, Python version, relevant dependency versions.
+    validations:
+      required: false
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs with secrets removed
+      description: Remove tokens, API keys, passwords, private paths, and raw transcript content.
+    validations:
+      required: false
+  - type: textarea
+    id: files
+    attributes:
+      label: Affected files
+      description: List known affected files or folders.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,44 @@
+name: Feature request
+description: Propose a scoped improvement.
+title: "[Feature]: "
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: objective
+    attributes:
+      label: Objective
+      description: What should this change achieve?
+    validations:
+      required: true
+  - type: textarea
+    id: use_case
+    attributes:
+      label: Use case
+      description: Who needs this and why?
+    validations:
+      required: true
+  - type: textarea
+    id: proposed_behavior
+    attributes:
+      label: Proposed behavior
+    validations:
+      required: true
+  - type: textarea
+    id: acceptance
+    attributes:
+      label: Acceptance criteria
+    validations:
+      required: true
+  - type: textarea
+    id: risks
+    attributes:
+      label: Risks
+      description: Include privacy, data integrity, generated artifact, or compatibility risks.
+    validations:
+      required: false
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+    validations:
+      required: false

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,20 @@
+## Summary
+
+## Scope
+
+## Files changed
+
+## Checks run
+
+## Publication safety
+- [ ] No `.env` or secrets included
+- [ ] No raw transcripts included
+- [ ] No generated artifacts included unless approved
+- [ ] `.env.example` is safe
+- [ ] `.gitignore` still protects local/private files
+
+## Risks
+
+## Rollback
+
+## Acceptance status

.github/workflows/ci.yml

@@ -0,0 +1,29 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+
+      - name: Run tests
+        run: |
+          python -m pytest tests -q

.gitignore

@@ -0,0 +1,49 @@
+# Secrets / local env
+.env
+.env.*
+!.env.example
+*.key
+*.pem
+*.p12
+
+# macOS / editor
+.DS_Store
+.idea/
+.vscode/
+*.swp
+
+# Python
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.venv/
+venv/
+env/
+
+# Logs / temp
+*.log
+*.tmp
+*.bak
+tmp/
+temp/
+
+# Local/private inputs
+input/raw/
+input/private/
+input/local/
+
+# Generated workspace/output artifacts
+workspace/
+publish/
+publish_assets/
+release_snapshots/
+artifacts/
+runs/
+outputs/
+output/
+
+# Local LLM / runtime caches
+.ollama/
+.cache/