Add a bug report issue template

[dangrondahl]

Description

.github/ISSUE_TEMPLATE/ currently holds only config.yml — the security contact link from #22. There's no bug report form, so "New issue" is a blank box. Every issue so far has been filed by maintainers who know what context to include; now the repo is public and installable via npx, that stops being true.

The cost of a blank box here is specific: a bug in this server is usually a bug in one of search_actions, execute_read_action, or execute_write_action against a particular action ID, from one of three install paths, on one of several MCP clients. Without those, the first reply is always the same round of questions.

Fields worth asking for

• Version — now actually answerable. Before Include the version in User-Agent, from a single source of truth #40/feat: include the version in User-Agent from a single source of truth #41 the server reported 0.1.0 regardless of release, so a reported version was worthless. It's now in the User-Agent and the MCP handshake.
• Install method — npx -y @kosli/mcp-server, .mcpb bundle, or local checkout. This matters more than it looks: sideloaded .mcpb bundles don't auto-update (README line 53), so bundle users are the ones most likely to report a bug already fixed in a later release.
• MCP client — Claude Code, Claude Desktop, Cursor, other.
• Node version — the floor is >=22 (chore: raise Node floor to 22 and keep @types/node aligned to it #38); older runtimes are a plausible cause rather than a bug.
• Kosli endpoint — EU (default), US (app.us.kosli.com), or single-tenant via KOSLI_BASE_URL. Region misconfiguration looks like a 404 or auth failure.
• Which tool and action ID — e.g. execute_write_action with create_or_update_env_action.
• What happened — expected vs actual, plus any error object. KosliClient returns { error: true, status, statusText, message } rather than throwing, so that object is usually the whole diagnosis.

One thing the template must do

Warn against pasting credentials. This server holds a Kosli API token, and the natural thing to paste — MCP client logs or a raw request — can contain the Authorization: Bearer … header or KOSLI_API_TOKEN. The form should say so at the point where output is pasted, not in a preamble nobody reads. A leaked token in a public issue is the most likely security incident this repo will actually have.

Open questions

• Keep blank_issues_enabled: true? Keeping it is friendlier and lets people file things that fit no template; turning it off forces the form. Given the repo is young and low-traffic, I'd keep blank issues enabled.
• A feature request template too? Out of scope here, but the same PR is the natural place if wanted.

Tasks

• Add .github/ISSUE_TEMPLATE/bug_report.yml (YAML form, not Markdown — it can mark fields required and render dropdowns)
• Include the credential warning next to the output field
• Auto-apply the bug label
• Decide on blank_issues_enabled