Add v0 release metadata

Author: IlyaasK

.github/release.yml

@@ -0,0 +1,20 @@
+changelog:
+  exclude:
+    labels:
+      - ignore-for-release
+  categories:
+    - title: Breaking Changes
+      labels:
+        - breaking-change
+    - title: Features
+      labels:
+        - enhancement
+    - title: Bug Fixes
+      labels:
+        - bug
+    - title: Documentation
+      labels:
+        - documentation
+    - title: Other Changes
+      labels:
+        - "*"

CHANGELOG.md

@@ -0,0 +1,20 @@
+# Changelog
+
+All notable changes to the Kernel Terraform provider are recorded here.
+
+## Unreleased
+
+Initial v0 release candidate:
+
+- Provider configuration for `api_key`, `base_url`, and `project_id`.
+- `kernel_browser_pool` resource for durable browser pool configuration.
+- `kernel_project`, `kernel_profile`, `kernel_proxy`, and `kernel_extension` lookup data sources.
+- `kernel_browser_pool` import support.
+- Unit tests, generated Terraform docs, examples, CI checks, and opt-in acceptance test harness.
+
+Intentionally unsupported in v0:
+
+- Runtime browser/session operations such as acquire, release, flush, app invocation, screenshots, logs, live view, and force recovery.
+- API key, project, profile, proxy, or extension resources.
+- `force_destroy` browser-pool deletion.
+- Terraform Plugin Framework code generation.

SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+## Supported Versions
+
+The provider has no public release yet; the first public release ships as a complete v1, and v0 tags stay internal. Before the first public release, confirm which released versions receive security fixes and update this section if support differs from latest-only.
+
+## Reporting Security Issues
+
+Do not open public GitHub issues for suspected vulnerabilities.
+
+Report vulnerabilities through Kernel's [vulnerability disclosure program](https://docs.onkernel.com/security-vulnerability-reporting), or email [security@kernel.sh](mailto:security@kernel.sh). GitHub private vulnerability reporting is also fine when it is enabled for this repository. Do not disclose details publicly until you receive a response.

docs/release.md

@@ -4,18 +4,21 @@ Use this checklist before publishing a Kernel Terraform provider version.
 
 ## Release Preconditions
 
+- The first public release ships as a complete v1. v0 tags and release artifacts stay internal to the Kernel organization; do not publish v0 to the public Terraform Registry.
 - Work from a clean `main` checkout after the PR stack is merged.
 - Run `bash scripts/check-docs.sh`.
 - Run `bash scripts/check-markdown-links.sh`.
 - Run `bash scripts/check-examples.sh`.
 - Run `terraform fmt -check -recursive examples`.
 - Run `go test -short -timeout=2m ./...`.
 - Run `go vet ./...`.
-- Run opt-in acceptance tests with real credentials before the first public v0 release:
+- Run opt-in acceptance tests with real credentials before the first public release:
   - `TF_ACC=1 KERNEL_ACC=1 KERNEL_API_KEY=... KERNEL_PROJECT_ID=... go test -count=1 -timeout=30m -v ./internal/resources/browserpool -run TestAcc`
   - or run the manual `Acceptance` GitHub Actions workflow with `KERNEL_API_KEY` and `KERNEL_PROJECT_ID` repository secrets configured.
 - Verify unscoped API calls send no `X-Kernel-Project-Id` header; it is sent only when a resource-level `project_id` or the provider default resolves a project.
 - Confirm `terraform-registry-manifest.json` contains protocol `["6.0"]` for Terraform Plugin Framework.
+- Confirm the repository license before the first public release. Do not publish a public tag until `LICENSE` exists or the release owner has explicitly documented the licensing decision.
+- Confirm GitHub private vulnerability reporting or a public security contact is configured and reflected in `SECURITY.md`.
 - Confirm there is no branch named like the release tag, for example `v0.1.0`.
 
 ## Registry Release Assets