update README.md

CONTRIBUTING.md

@@ -0,0 +1,61 @@
+# Contributing
+
+## Build from source
+
+```bash
+make build
+sudo ./build/bin/banger system install --owner "$USER"
+```
+
+`make build` produces three binaries under `./build/bin/`:
+
+- `banger` — the user-facing CLI
+- `bangerd` — the owner-user daemon (exposes `/run/banger/bangerd.sock`)
+- `banger-vsock-agent` — the in-guest companion
+
+`system install` copies them into `/usr/local`, writes install
+metadata under `/etc/banger`, lays down `bangerd.service` and
+`bangerd-root.service`, and starts both. After that, daily commands
+like `banger vm run` are unprivileged.
+
+To inspect or refresh the services:
+
+```bash
+banger system status
+sudo banger system restart
+```
+
+The two-service split (owner daemon + privileged root helper) is
+explained in [`docs/privileges.md`](docs/privileges.md), including
+the exact capability set the root helper holds.
+
+## Tests
+
+```bash
+make test            # go test ./...
+make coverage        # per-package + total statement coverage
+make lint            # gofmt + go vet + shellcheck
+```
+
+The smoke suite (`make smoke`) builds coverage-instrumented binaries,
+installs them as a temporary systemd service, and runs end-to-end
+scenarios against real Firecracker. Requires a KVM-capable host and
+`sudo`. `make smoke-list` prints scenario names; `make smoke-one
+SCENARIO=<name>` runs just one. See the smoke comments in the
+`Makefile` for details.
+
+## Pre-commit hook
+
+```bash
+make install-hooks
+```
+
+Points `core.hooksPath` at `.githooks/`, which runs lint + test +
+build on every commit. Bypass with `git commit --no-verify`; revert
+with `git config --unset core.hooksPath`.
+
+## Internals
+
+- [`docs/privileges.md`](docs/privileges.md) — daemon split, capability set, trust model.
+- [`docs/release-process.md`](docs/release-process.md) — cutting and signing a release.
+- [`AGENTS.md`](AGENTS.md) — repo-wide notes for code agents.