#18 chore: require pull requests to close an issue

What and why

Adds a Linked issue check. Pull requests into main whose description doesn't close an existing issue (Closes #N, Fixes #N, Resolves #N) fail the check.

• .github/workflows/linked-issue.yml: runs on pull_request_target with read-only permissions and never checks out PR code, so fork PRs can't run their own code through it.
• CONTRIBUTING.md: documents the issue-first rule under Pull requests.

pull_request_target runs the workflow from the base branch, so the check starts applying to PRs opened after this merges. It doesn't run on this PR.

The other checks (cubic, GitGuardian, Socket) are GitHub Apps installed at org level and need no repo changes.

Checklist

• bun run check passes
• Tests cover the change
• Changeset added (bunx changeset), or not needed for docs, tests, or internal changes
• Docs updated if behavior or APIs changed

Summary by CodeRabbit

• New Features
  • Pull requests targeting the main branch are checked for a linked issue when opened, edited, reopened, or updated. The check passes when the description references an issue with a closing keyword and fails when no matching issue is found or the check cannot verify one.
• Documentation
  • Contribution guidance asks contributors to open or find an issue and include a closing reference in the pull request description. Pull requests without a linked issue will not be reviewed.