chore: add Code of Conduct

[mbevc1]

Add Code of Conduct

Checklist

• Helm chart (charts/k8s-reporter/) updated, if needed. Note: these changes live in a separate PR
• Terraform provider and related changes (terraform-provider-kosli, terraform-aws-evidence-reporter, terraform-aws-kosli-reporter) updated, if needed
• Docs are autogenerated from CLI help — make sure the help text reflects your changes

[claude]

Claude finished @mbevc1's task in 54s —— View job

---

Code review: Code of Conduct

• Read the changed file (CODE_OF_CONDUCT.md)
• Assess static-analysis needs
• Review content & consistency
• Post feedback

---

This PR adds a standard Contributor Covenant Code of Conduct. It's a documentation-only change (one new Markdown file), so the Go static-analysis phase (go build / go vet / go mod tidy) doesn't apply — nothing in the build is affected. 👍

Findings

1. Inconsistent line-wrapping (minor) — CODE_OF_CONDUCT.md:106
The rest of the document is hard-wrapped at ~80 columns, but the "Permanent Ban" paragraph is a single long unwrapped line. I've left an inline suggestion to reflow it for consistency and cleaner future diffs.

2. Enforcement contact (worth confirming, non-blocking) — CODE_OF_CONDUCT.md:61
Conduct reports are routed to security@kosli.com, the same address used in SECURITY.md for vulnerability disclosure. That's a valid choice, but worth double-checking it's the intended inbox for conduct reports rather than a dedicated alias — the two report types often go to different people.

3. Version vs. wording (informational)
The Attribution section cites Contributor Covenant v2.0, but the "Permanent Ban" wording (...for which a temporary ban is not deemed sufficient OR demonstrating a pattern...) matches v2.1. Not a problem for a customized CoC, just flagging that the cited version and the text have drifted slightly if you want them to line up.

Nice work

• Clean, complete adoption of a well-recognized standard.
• Spelling ("behaviour", "apologizing") is applied consistently throughout.
• Providing a real enforcement contact rather than leaving the template placeholder is the right call.

Overall this is good to merge once the wrapping nit is addressed (or intentionally skipped).
• branch mbevc1-patch-1