Barcar patch 1

[barcar]

Note

Low Risk
Low risk: changes are limited to repository policy documentation and a GitHub Actions permission scoping tweak. Main impact is on release automation if the workflow needs additional permissions beyond contents: read.

Overview
Adds CODE_OF_CONDUCT.md (Contributor Covenant v2.0) with enforcement contact details.

Updates the PyPI release workflow (publish-pypi.yml) to explicitly scope the publish job’s GitHub token permissions to contents: read.

^{Written by Cursor Bugbot for commit aa71de2. This will update automatically on new commits. Configure here.}