docs: add contribution receipt template

[hummbl-dev]

Summary

• Add docs/CONTRIBUTION_RECEIPTS.md with a PR receipt template for scope, run mode, redaction, claim changes, and verification.
• Add a lightweight model/harness matrix so benchmark comments can separate model, provider, harness, target class, run mode, attempts, failures, and abstentions.
• Link the new doc from README.md and CONTRIBUTING.md.

Contribution Receipt

• Change: docs-only receipt guidance for PRs and benchmark/model-matrix discussions.
• Scope class: docs_only.
• Target authority: not_applicable.
• Network use: none for T3MP3ST runtime or target execution; GitHub was used only for fork/branch/PR workflow.
• Run mode labels: static_test, manual_review, docs_only.
• Model/harness labels: not_applicable for measured capability; template includes proposed model/harness fields.
• Commands run:
  • npm install -> pass, 0 vulnerabilities reported by npm audit.
  • npm run typecheck -> pass.
  • npm test -> pass, 28 files / 323 tests.
  • npm run doctor -> pass, 28/33 checks with optional warnings for missing nmap, nuclei, semgrep, promptfoo, and offline API health.
  • npm run verify-claims -> pass, 24/24 claims verified.
• Artifacts: docs/CONTRIBUTION_RECEIPTS.md, README and CONTRIBUTING links.
• Redaction: no secrets, tokens, credentials, private keys, target data, or raw evidence included.
• Claims changed: none; no headline numbers or capability status labels changed.
• Abstentions/refusals: none measured.
• Residual risk: docs-only proposal; maintainers may want to rename fields or fold this into an existing release/checklist doc.

Safety Boundary

No Arsenal tools, MCP tools, local agents, scans, lab targets, or external targets were executed for this PR.

[jmagly]

Content is fine — just needs a rebase (README.md and CONTRIBUTING.md have moved, so it's showing as conflicting). No logic to change. Worth noting for triage: this is a receipt/matrix template, so it doesn't close #7 (which is about actual per-model benchmark numbers) — they're separate, and the PR correctly doesn't claim otherwise.

[hummbl-dev]

Rebased and conflicts resolved (README.md + CONTRIBUTING.md). PR is now mergeable. The merge needs to be done by a maintainer with write access to elder-plinius/T3MP3ST, as the hummbl-dev token doesn't have merge permissions on this fork's PR.