chore: OSS hygiene + parser/timezone polish

[milmazz]

Summary

Contributor-friendliness and a couple of correctness/clarity polishes, split out from the larger checklist. Code of Conduct is intentionally left out of this PR and will follow once the rest is reviewed.

OSS hygiene

• SECURITY.md — private reporting via GitHub vulnerability advisories, with a section calling out HTML-sanitizer bypasses as in-scope.
• .github/ templates — issue forms (bug_report, feature_request, config.yml) and a PULL_REQUEST_TEMPLATE.md. The issue config.yml routes security reports to private advisories and questions to Discussions.
• Credo — added as a dev/test dep with a generated .credo.exs, wired into mix precommit and a new CI lint job running mix credo --strict. Fixed the 3 issues it surfaced (two parse_rss/parse_atom nesting refactors via extracted helpers; one test string switched to a sigil) — all behavior-preserving.
• Generated-code drift check — the CI lint job regenerates lib/exoplanet/datetime_parser.ex from its .ex.exs source and fails if the committed file differs, so the generated file can't silently drift. The volatile # Generated at timestamp header is ignored via git diff -I.

Minor polish

• rss_body?/1 hardening — feed-type detection now inspects only the first real (root) element instead of scanning the whole body for <rss/<rdf:RDF. An Atom feed that merely mentions those strings inside an entry's content is no longer misparsed as RSS. Added a regression test.
• Timezone-loss trade-off documented — both date paths (DateTimeParser and NaiveDateTime.from_iso8601/1) discard UTC offsets, so cross-feed ordering can be skewed by up to ~24h. Now stated in the README and Exoplanet.Post docs (and referenced at the sort site) rather than living only in a code comment.

Notes for the reviewer

• The Credo lint CI job and the drift check run once on Elixir 1.18 / OTP 27 (version-independent), separate from the test matrix.
• config.yml links to GitHub Discussions; enable Discussions on the repo or I can repoint that link if you'd prefer.
• The security/issue contact uses GitHub private vulnerability reporting — make sure "Private vulnerability reporting" is enabled under repo Settings → Security.

Test plan

• mix precommit green (format, credo --strict, docs, 138 tests, 0 failures)
• New regression test: Atom feed with literal <rss/<rdf:RDF in content parses as Atom
• Drift-check command verified locally (passes when source and generated file agree)

🤖 Generated with Claude Code