docs: add reproducibility note

Reviewed head 617e5ac. Two documentation points to address before this is ready:

1. Please confirm the security-reporting recipient with the maintainers. The new SECURITY.md directs reports to security@playnexus.io, but I could not find maintainer approval for that address in this PR or #115. A root security policy will guide where researchers send potentially confidential reports. Could this file be left out of the reproducibility change until the maintainers confirm the intended channel? This is a request to verify authorization, not a claim that the address is malicious.

2. The new pinning statement does not match the requirements. Eleven dependency declarations still use version ranges; only bcrypt is exactly pinned. The added # pinned for reproducibility - see CONTRIBUTING comment therefore promises something this change does not provide, and the new CONTRIBUTING.md contains no reproducibility instructions. Please remove the statement or describe the existing ranges accurately; adding a lockfile or changing dependency versions would be a separate scope decision.

The description currently mentions only a requirements note, whereas the diff also adds four governance/changelog files. Please make the description match the intended scope, or omit those unrelated additions.