📖 docs: add pull request template and README Contributing section

.github/pull_request_template.md

@@ -0,0 +1,26 @@
+## Summary
+
+<!-- What does this PR change on hivecommons.dev, and why? Name the pages or shortcut redirects it touches. -->
+
+Closes #<!-- issue number, if this PR resolves one -->
+
+## Screenshots
+
+<!-- For a visible change, attach desktop and mobile screenshots (before/after if it alters existing content). Delete this section otherwise. -->
+
+## Checks run locally
+
+<!-- From the repository root; see README "Local preview and running the checks". Note any you could not run. -->
+
+- [ ] `node --test scripts/*.test.mjs`
+- [ ] `scripts/check-links.test.sh`
+- [ ] `scripts/check-redirects.test.sh`
+- [ ] `scripts/check-redirects.sh`
+
+## Checklist
+
+- [ ] Shortcut redirects were changed only through the `MAP` in `make-redirects.sh`, followed by `./make-redirects.sh` (no hand-edited redirect pages)
+- [ ] After editing an inline `<script>`, I ran `node scripts/update-csp-hashes.mjs`
+- [ ] A new top-level page is listed in `sitemap.xml`
+- [ ] A change to the integration or sponsor lists in `index.html` is mirrored in `llms.txt`
+- [ ] Commits are signed off (`git commit -s`), as the org [CONTRIBUTING.md](https://github.com/hivecommons/.github/blob/main/CONTRIBUTING.md) requires

README.md

@@ -443,6 +443,14 @@ requirements first (see [issue #73](https://github.com/hivecommons/hivecommons.g
 
 **Incident response** — When a bad deploy or incident impacts visitors of `hivecommons.dev` (broken pages, dead redirects, domain issues), use the [postmortem template](runbooks/postmortem-template.md) to document it blamelessly and fact-based. Coordinate recovery using the [release-rollback runbook](runbooks/release-rollback.md).
 
+## Contributing
+
+Contributions follow the org-wide [CONTRIBUTING.md](https://github.com/hivecommons/.github/blob/main/CONTRIBUTING.md);
+every commit needs a DCO sign-off (`git commit -s`). Opening a pull request pre-fills
+`.github/pull_request_template.md`, whose checklist covers this repository's own rules: the
+checks under [Local preview and running the checks](#local-preview-and-running-the-checks),
+generated [shortcut redirects](#shortcut-redirects), CSP hashes, `sitemap.xml` and `llms.txt`.
+
 ## Code of Conduct
 
 Hive Commons website contributors are expected to follow the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/main/code-of-conduct.md).

scripts/doc-paths.test.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-// Static gate over the repository paths named in backticks by README.md and
-// runbooks/*.md. The prose there is how a contributor (or an on-call reader at
+// Static gate over the repository paths named in backticks by README.md,
+// runbooks/*.md and the pull request template (every committed *.md). The prose there is how a contributor (or an on-call reader at
 // 3am) finds `scripts/check-links.sh`, `.github/workflows/scorecard.yml` or
 // `.well-known/security.txt`; nothing else notices when a script is renamed,
 // a workflow dropped or a runbook moved while the prose keeps pointing at the
@@ -198,6 +198,10 @@ test("README.md and runbooks/*.md are present and name at least one repository p
   assert.ok(claims.length > 0, "no backticked repository paths found — the gate has nothing to check");
 });
 
+test(".github/pull_request_template.md is scanned, so the paths its checklist names stay live", () => {
+  assert.ok(".github/pull_request_template.md" in DOCS, ".github/pull_request_template.md missing");
+});
+
 for (const name of Object.keys(DOCS)) {
   test(`${name}: every backticked repository path resolves to a committed file or directory`, () => {
     assert.deepEqual(docPathProblems({ [name]: DOCS[name] }, { root: ROOT, topDirs: TOP_DIRS }), []);