repo: governance, licensing, and the injected clock

Establishes the repository under the PostHog licensing model: MIT everywhere
except ee/, which carries the Antifailure Enterprise License. ADR 0002 records
why, including why there is no CLA and why Elastic License 2.0 was superseded.

Adds the governance surface in final prose with no placeholders: code of
conduct, security policy with response targets, contributing guide, issue and
pull request templates, CODEOWNERS covering the five security sensitive paths,
and ADR 0001 on the language split.

Adds internal/clock, the only source of time library code may use, with a fake
that releases waiters in deadline order so TTLs, retries, and schedulers are
testable without wall time. Adds secrets.Value, which renders as [redacted]
through every fmt verb, JSON, YAML, and slog, so a missed call site cannot
leak.

Records six open questions in docs/plan/QUESTIONS.md, including the finding
that Crowdi-Agents carries no license and so cannot be copied into an MIT
repository.

Failure paths covered:
  fake clock releases out of order: TestFake_Advance_ReleasesWaitersInDeadlineOrder
  cancelled sleep leaks a waiter: TestFake_Sleep_ReturnsContextErrorWhenCancelledFirst
  backwards clock move fires a timer: TestFake_Set_MovingBackwardsDoesNotReleaseWaiters
  secret reaches a formatter: TestValue_NeverRendersThePlaintext
  secret reaches a marshaller or a log: TestValue_MarshallersRenderTheMarker, TestValue_SlogRendersTheMarker

Signed-off-by: Vir Sanghavi <Virrsanghavi@gmail.com>