Add governance policies and PR-driven CI validation

[TX-RX]

Summary

Adds the standard set of GitHub repo policies and a CI workflow that mechanically enforces the contribution rules so we don't have to remember to check them by hand.

Policy files

• CODE_OF_CONDUCT.md — Contributor Covenant 2.1 with a short summary inline.
• SECURITY.md — what is and isn't a security issue here, private reporting via GitHub Security Advisories, response SLA, coordinated-disclosure window.
• CONTRIBUTING.md — the five contribution rules with rationale, local validator command, PR process, code style, and license-by-PR.
• .github/PULL_REQUEST_TEMPLATE.md — a checklist that mirrors the five rules so every PR has to attest to each one.

CI

• .github/workflows/validate.yml runs on every PR to main (and on push to main) on windows-latest. Installs PSScriptAnalyzer and runs the validator.
• .github/scripts/Validate-Pranks.ps1 performs five checks:
  1. PowerShell parse errors across every .ps1.
  2. PSScriptAnalyzer findings — Error blocks; Warning advisory.
  3. Paired Install-<X> / Uninstall-<X> for every top-level payload.
  4. Denylist of malicious patterns + outbound-host allowlist.
  5. README mentions every top-level payload.
• .github/scripts/denylist.json holds the regex patterns and host allowlist as pure data. The rules can evolve without touching the validator, and — importantly — keeping the literal pattern strings (VirtualAlloc, Mimikatz, registry Run-key paths, etc.) out of the .ps1 means AMSI doesn't quarantine the validator itself. (An earlier inline version got blocked locally by Defender during testing.)

README

Updated to link the new policy docs.

Test plan

• Validator runs cleanly on the current repo contents: pwsh -File ./.github/scripts/Validate-Pranks.ps1 — verified locally, exits 0.
• CI on this PR is green.
• PR template renders correctly when opening a new PR.
• Manually craft a test PR that violates one rule (e.g. a script with Set-MpPreference -DisableRealtimeMonitoring) and confirm validate.yml fails.

Notes for reviewers

• The Mimikatz denylist pattern uses a M[i]mikatz regex trick to match the real name while not containing the literal string statically — this is the same pattern AV-evasion vendors use defensively when shipping detection rules. Documented inline.
• The network allowlist currently includes only catfact.ninja and raw.githubusercontent.com/TX-RX/. New endpoints require an allowlist update in the same PR that introduces them.
• The validator emits an advisory warning (not failure) when it sees a non-allowlisted URL in a code comment — currently the <you>/OfficePranks/main/... placeholder in Install-CatFacts.ps1. Acceptable.

🤖 Generated with Claude Code