docs: add release-readiness baseline

[bntvllnt]

Summary

• Add minimal release-readiness docs for @vllnt/typescript: CHANGELOG.md, CONTRIBUTING.md, SECURITY.md, AGENTS.md, llms.txt, and llms-full.txt
• Document the current public TypeScript preset package, contribution/security expectations, and no-release agent guardrails
• No version bump, tag, publish, merge, or announcement action taken

Verification

• npm test (3 tests passed)
• npm pack --dry-run
• git diff --check HEAD~1..HEAD

Review gate

{"branch":"vllnt-oss","tenant":"releases","aor_fit":true,"context_read":true,"evidence_attached":true,"opsec_checked":true,"safe_for_next_step":true,"blocking_findings":[]}

[greptile-apps]

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

[bntvllnt]

Review — 0 findings (0 blocking, 0 warn)

BLOCKING

None.

WARN

None.

VERIFIED CLEAN

• Full changed-file coverage: AGENTS.md, CHANGELOG.md, CONTRIBUTING.md, SECURITY.md, llms.txt, and llms-full.txt.
• The added release-readiness docs stay inside the package's public docs/policy surface and do not change package code, presets, package metadata, tags, release workflow behavior, or npm publishing state.
• Public package facts in the new docs match the current repo/package evidence: @vllnt/typescript is MIT, Node.js >=22, npm version 1.0.0, tag v1.0.0 exists, and the CI/smoke-test backfill happened after that tag.
• No private VLLNT operational details, credentials, customer data, local paths, or unsupported customer/support commitments were introduced.
• Security wording is appropriately scoped for a TypeScript config package and does not promise a fixed SLA.
• Release actions remain intentionally human-controlled: no version bump, tag, npm publish, merge, or release action was taken.

VALIDATION

• Reviewed exact head: aa2d97937471f3804c3cdd4ddea1c2754f1f20c8.
• GitHub checks at review time: Validate SUCCESS; CodeQL / Analyze (actions) / Analyze (javascript-typescript) SUCCESS.
• Local validation: npm test passed (3/3 smoke tests); npm pack --dry-run passed and confirmed the published tarball surface remains the five preset JSON files plus README.md, LICENSE, and package.json.
• Viewed-state coverage: all six changed files were marked viewed.

Approval is recommended, but final approval is reserved for bntvllnt.