chore: adopt Biome + Stylelint, modernize CI/CD, add security/support docs, minor JS fixes

- Linting/format
  - Replace ESLint/Prettier with Biome; remove old configs; add `biome.json`; update scripts
  - Tailwind-friendly `.stylelintrc.yaml`; Stylelint and Biome pass
  - Enable Biome across `modules/**`; prune legacy JS globals; ignore oversized `devicon.json`

- Code fixes
  - `hb-theme.js`: avoid assignment-in-expressions; clearer dataset updates
  - `hugoblox-slides.js`: fix inner var scope (var → let); apply formatting

- CI/CD
  - Split lint/build workflows; add path filters; Node via Corepack (pnpm from package.json)
  - Hugo pinned to env `HUGO_VERSION`; add consistency check vs `starters/academic-cv/hugoblox.yaml`
  - Nightly starters matrix build (academic-cv, landing-page); CodeQL weekly; resource caches

- Workflows/Community
  - Greeter: switch to `pull_request_target`; add Contributor Guide to PR message
  - PR labeler for path-based labels

- Repo policies/docs
  - `CODEOWNERS` for `@gcushen`
  - `SECURITY.md`, `SUPPORT.md`
  - Documented branch protection in `.github/settings.yml`
  - Move `CODE_OF_CONDUCT.md` to `.github/`

- docs(zh): update `README.zh.md` translation

Notes:
- pnpm is sourced from `package.json: packageManager` via Corepack; no hard-coded pnpm versions in CI.

.github/SECURITY.md

@@ -0,0 +1,28 @@
+# Security Policy
+
+We take security seriously and appreciate responsible disclosures.
+
+## Supported Versions
+
+We generally support the latest release of Hugo Blox modules and starters. Security fixes may be backported at the maintainers' discretion.
+
+## Reporting a Vulnerability
+
+- Do not open a public issue.
+- Instead, open a private GitHub Security Advisory for this repository (Security tab → Report a vulnerability).
+- If you cannot access advisories, email the maintainers via the repository's contact links on GitHub.
+
+Please include:
+
+- A clear description and minimal reproduction
+- Impact assessment and potential exploit scenario
+- Suggested remediation, if known
+
+We will acknowledge receipt within 72 hours and keep you updated.
+
+## Scope
+
+- This repository and official Hugo Blox modules/starters
+- Third-party templates and plugins are out of scope
+
+Thank you for helping keep the community safe.