Adopt the AI-native SDLC and repository policies #634

Problem

More and more b2-sdk-python PRs are written with coding agents, and nothing in the repo tells an agent (or a new contributor) how this codebase works or what reviewers keep asking for. The rules live in reviewers' heads and in past review threads: towncrier fragments in changelog.d/ with the right name and type, changes made in b2sdk/_internal and exported through the right b2sdk/vN apiver layer without breaking older layers, raw_simulator.py kept in step with raw_api.py, tests that fail when the fix is reverted, retry and Retry-After parity, and the .sdkharness contract checks that CI does not run. The release steps are a single line in README.release.md.

The repo also lacks the standard policy files: no AGENTS.md/CLAUDE.md, REVIEW.md, SECURITY.md, CODE_OF_CONDUCT.md, PR template or issue forms.

Proposed outcome

• Agents and contributors read the recurring review lessons before they write code (AGENTS.md, CLAUDE.md, docs/review-lessons.md), and reviewers follow one written process (REVIEW.md).
• Keep towncrier and the existing CI changelog check; document them where agents look, and make the local check easy to run.
• A documented release process (RELEASE.md, replacing README.release.md), security policy, code of conduct, PR template and issue forms.
• One documented local command sequence that mirrors CI (nox -s lint, unit, build, doc, towncrier_check).
• Larger changes start from intent/<slug>/intent.md → spec.md → plan.md, following the AI-native SDLC playbook, with the playbook skills in .claude/skills/.
• A proposal, for the maintainers to decide, on scaling human review by risk (tiers, re-approval on new commits, required conversation resolution, automated AI and security review, merge queue, reviewer evals, metrics).

Settings that need a repo admin

• Enable private vulnerability reporting (needed by SECURITY.md and the issue form's security link).
• Decide whether the changelog validation step should become a required check on master.
• Confirm which branch protection is applied to master.
• Review intent/review-process/intent.md and accept, reshape or close it.