chore: close the remaining immich parity gaps

[ttncode]

What this changes

Closes the gaps a full survey found between this toolbox and immich, the project
it was derived from. Nine commits, one intended behaviour change — a test that
can now fail for the reason it was written.

Files immich has and this repository did not. It ships SECURITY.md and
CODEOWNERS into every generated project and carried neither itself. It
enforces a pull request body on its own pull requests, with a CI job, and
shipped no template to clients. Both are fixed, plus .vscode/ for this
repository and for generated ones — recommending shellcheck and
shell-format, which mise.toml already pins, and telling an editor that the
extensionless scaffold file is bash.

A name on every workflow step. 63 steps across four workflows had none.
immich names 297 of its own and sits at 3.8% comments against our 17.5%; the
difference is not that they explain less, it is where. A step's name appears in
the GitHub log while the job runs. No comment was deleted — every one that
survives annotates a key that is not a step.

local -r, and comments down to their facts. immich's install.sh is 107
lines with three comments because main() reads as prose and the function names
narrate. local -r is function scope, unlike the file-level readonly this
repository correctly rejects: these libraries are re-sourced into child
processes by design. 98 declarations converted.

The data files. adapters/*/adapter.env ran to 76%, common/.dockerignore
to 79% where immich's carries none at all.

What the survey found and left alone. The bats suites are at 19% against
immich's 0.9%, and nothing was cut there. The premise this task was written on —
that the dominant pattern is a comment restating the test name — turned out
false when measured: only 13 of ~298 tests carry any comment above them, and
none restates its name. The 836 comment lines live inside test bodies recording
why an assertion is shaped as it is, which is the category worth keeping.

How it was verified

• mise run test-runner at every task — 263 tests, 0 failures, under the
  runner's own environment.
• mise run lint and mise exec -- zizmor --min-severity medium at every task.
• A whole-branch review on the most capable model, which independently parsed
  all 98 local -r declarations into their function bodies and searched each
  for a later write — reassignment, +=, read, unset, printf -v, indexed
  assignment, env-prefix use. Zero real hits.
• Structural checks run directly rather than taken on report: the exact string
  mise exec -- bash -c "$2" still appears once in lib/adapter.sh;
  lib/publish.sh still opens { and closes EOF at column zero twice each;
  no file-level readonly exists; double-sourcing lib/log.sh and
  lib/service.sh in one shell under set -euo pipefail still succeeds; every
  ADAPTER_* and SERVICE_* assignment is byte-identical.
• Generated a project with an explicit owner: CODEOWNERS resolves to it, the
  new .vscode/extensions.json and .github/pull_request_template.md arrive,
  and no file carries a surviving placeholder.
• The new assertion was proven red: common/CODEOWNERS was temporarily set to a
  wrong-but-non-placeholder account, the test failed with the expected message,
  and the file was restored.

One local -r broke three tests during implementation — block="$2" in
lib/service.sh, where the line below uses the env-prefix form
block="$block" awk ..., which bash refuses on a readonly name. Reverted to
plain local and caught by the suite, not by review.

Checklist

• mise run lint passes
• mise run test-runner passes
• New behaviour has a test that fails without the change
• Docs that describe changed behaviour were updated in the same commit
• No unrelated changes