docs: sync CONTRIBUTING.md with current process

[chaksaray]

Summary

Two-part task: (1) audit and expand good first issue labeling from
the real backlog, (2) confirm CONTRIBUTING.md matches the current,
real process and fix any drift found.

Note on base branch: targets develop, not main — per this PR's
own fix (see below), that's now the stated, correct convention, so it
would be a little embarrassing for this specific PR to target main.

Part 1: good-first-issue audit — honest result, not a forced one

Real current state checked first: only #125 has ever carried the
label, and it's closed. Zero open coverage.

Surveyed the full open backlog (12 issues) for genuinely small,
low-risk, clear-edged candidates. Found zero that qualify, not for
lack of looking:

• Crosswalk contribution: mapping an execution-evidence predicate onto AVE's evidence fields #94, Make commit required in crosswalk schema (after backfill lands) #126 — explicitly blocked, not actionable
• Design question: confidence_baseline is self-reported, no structural verification #98, v1.2.0 roadmap #105, Define an explicit record abstraction policy: class vs. variant (credit: endor_sarah, Endor Labs) #72, Crosswalk staleness audit: zero files fully clean, three questions for source_commit sequencing #160 — open design/policy questions with no
  stated resolution (#160's own title says "three questions") —
  exactly what a first issue should not be
• v1.2.0: add owasp_ast schema field #103, v1.2.0: implement deprecation policy schema fields #104, Schema v1.2.0: require owasp_asi, mitre_atlas, nist_ai_rmf keys to always exist (empty array allowed) #178 — schema-version changes, requiring this
  project's own frozen-schema-version discipline; too consequential
  for an unsupervised first contribution
• [AVE] New class: local-skill-name-collision (registry_metadata layer) #150, and the one remaining item in Taxonomy gaps identified by cfgaudit crosswalk (credit: predictor2718) #68 — both require the
  full add-ave-record research/AIVSS-scoring/fixture workflow, the
  project's most sensitive, expertise-gated task, regardless of how
  well-scoped the underlying proposal is

Not forcing labels onto issues that don't fit the bar just to produce
a number. Real side-finding instead: #68's original 8-item gap
list turned out to be 7/8 stale — resolved by records shipped since it
opened (AVE-2026-00061/62/63/64/71/72/73). Posted the status
as a comment
rather than sit on it, left the issue open for the one real remaining
gap (sandbox-config weakening).

Part 2: CONTRIBUTING.md drift — four real corrections, not cosmetic

Checked against docs/specs/researcher-process.md's current content,
the actual schema, and the real scripts in scripts/:

1. researcher field said "Use your name or handle" — the exact
   misattribution mistake researcher-process.md exists to prevent,
   and one this project has actually shipped and had to correct (see
   its AVE-2026-00060 worked example, and the real AVE-2026-00070
   fix). Corrected to state the real rule.
2. owasp_asi/mitre_atlas/nist_ai_rmf said "omit rather than
   force a poor fit" — the literal bug found and fixed on
   AVE-2026-00078/79/80 (Schema v1.2.0: require owasp_asi, mitre_atlas, nist_ai_rmf keys to always exist (empty array allowed) #178, owasp_asi field: corpus and schema use fabricated ASI01-10 IDs, primary source uses T1-T17 #179). Corrected: always include the
   key, [] when nothing fits.
3. Validation commands showed an ad-hoc Node/ajv snippet, no
   mention of the actual canonical scripts/validate_records.py /
   scripts/check_fixtures.py / pytest tests/. Replaced with the
   real commands this project (and its CI) actually runs.
4. Fixture location + PR base branch: said detection-rule fixtures
   live in bawbel/scanner and told contributors to target main.
   Both wrong against actual practice — fixtures live in this repo's
   own tests/fixtures/ (check_fixtures.py enforces it here), and
   real record PRs target develop. Corrected both, and added
   origin/develop to the git checkout -b examples so a new
   contributor doesn't branch from the wrong base and hit an avoidable
   merge conflict later (this exact class of conflict happened for
   real, separately, this same day).

Every correction states what changed and why inline — no silent
rewrites.

Checklist

• Confirmed real current label counts before assuming
• No new tasks invented — every good-first-issue candidate
  considered came from the real, existing backlog
• CONTRIBUTING.md checked against real, current files, not
  memory
• Real corrections get a visible note, not a silent overwrite
• python3 scripts/validate_records.py (80/80), pytest tests/
  (339 passed) — unaffected doc-only change, confirmed anyway