feat: issue forms & developer guide - #2

What & why

Second of the initial PR set: the GitHub issue intake forms and the external
developer documentation. Implements the developer-documentation spec
(docs/specs/2026-07-06-spec-developer-documentation.md) §7 (forms) and §1–§10
(guide), plus the intake config.yml.

Built test-first — the two commits show the TDD loop:

1. test: — conformance harness asserting the invariants (fails, red).
2. feat: — the artifacts that satisfy them (passes, green).

Artifacts

• .github/ISSUE_TEMPLATE/certificate-request.yml — CSR + repo, two required
  fields (spec §7.1).
• .github/ISSUE_TEMPLATE/revocation-request.yml — signed self-service
  revocation (spec §7.2).
• .github/ISSUE_TEMPLATE/config.yml — blank issues disabled; abuse / lost-key
  reports routed to the Security Advisory (VDP) (design §7.1 case 3).
• docs/developer-guide.md — external developer guide.

Conformance invariants pinned (test/forms_test.go)

• Both forms parse; cert-request has exactly two required inputs + label
  cert-request; revocation-request has cert + signed_request + label
  revocation-request.
• The security-critical appId regex ^[a-z][a-z0-9_-]{1,63}$ (design §4.1)
  appears in the form and the guide (must not drift).
• The challenge path /.well-known/owncloud-codesigning-challenge.txt (§5.3)
  appears in the guide.
• No unresolved <codesigning-repo> placeholder in the guide.

Notes

• <codesigning-repo> resolved to DeepDiver1975/developer-certificates.
• The two spec-level TBDs — Mode-2 bind(H,T) token layout and the
  signed-revocation statement bytes — are surfaced in the guide as explicit
  "not yet finalized" notes rather than invented; they land with the attestation
  and revocation-bot PRs.

Checklist

• Scoped to a single concern (forms + docs)
• Spec sections referenced (docs/specs/…-developer-documentation.md)
• test/ harness passes (cd test && go test ./...)
• No workflow changes (SHA-pinning already in place)
• Commits DCO signed-off and signed

🤖 Generated with Claude Code