docs: add contributing guide

[pppolf]

Summary

• add a Chinese-first bilingual contribution guide for the current Go/TypeScript/Rust architecture
• document pinned toolchains, Windows Desktop prerequisites, vertical-slice and ADR expectations, safety invariants, generated OpenAPI workflow, and focused/full validation
• add a small README entry so prospective contributors can find the guide

Why

The repository has detailed architecture and progress records, but no single contributor entry point. New contributors currently have to infer setup, generated-file ownership, validation scope, and security boundaries from CI, scripts, and many ADRs. This guide makes those expectations explicit without changing runtime behavior.

Impact

Contributor onboarding becomes more reproducible and review scope becomes easier to audit. This is documentation-only: it adds no API, persistence, process, network, credential, file-write, or execution authority.

Validation

• git diff --check
• verified all 12 relative Markdown links resolve in the checkout
• cross-checked toolchain versions and documented commands against go.mod, analyzers/rust-toolchain.toml, .github/workflows/ci.yml, web/package.json, Desktop scripts, and OpenAPI documentation
• Go/Web/Rust test suites (documentation-only change; Go and Rust are unavailable in this local environment, and web/node_modules is not installed; GitHub CI will run the repository matrix)

Audit

• No credentials or local runtime data are included.
• Policy, workspace, sandbox, persistence, and generated-contract boundaries were reviewed.
• README links to the new contributor entry point.