docs: state the bug-fixes-only scope explicitly

Maintenance mode now means a concrete policy rather than a tone: correctness,
panics and security are in scope; new tables, new API and performance work are
not, and feature requests are closed.

Says so in both places a contributor looks before opening something, and spells
out the in/out lists in CONTRIBUTING so the boundary is checkable rather than a
judgement call.

Author: Goldziher

CONTRIBUTING.md

@@ -4,6 +4,28 @@
 TrueType, OpenType and AAT fonts. It sits underneath text rendering and it parses untrusted
 input, so contributions are held to that standard.
 
+## Scope
+
+**The crate is in maintenance mode: bug fixes only.**
+
+In scope, and welcome:
+
+- Incorrect parsing, wrong values, glyphs that fail to outline
+- Panics, aborts and unbounded work on malformed input
+- Fixes to existing table support
+
+Out of scope, and will be closed:
+
+- New table support and new public API
+- Performance work
+- Refactors that change the API surface
+
+If you need broader coverage, [fontations](https://github.com/googlefonts/fontations) is
+actively developed and is what we recommend for new projects.
+
+A bug report does not need to be phrased as a fix — if a font renders wrong, say so and we
+will work out whether the cause is in scope.
+
 ## Repository layout
 
 The repository root is **not** a Cargo workspace. It holds four independent crates:

README.md

@@ -6,9 +6,11 @@
 [![Rust 1.88+](https://img.shields.io/badge/rust-1.88+-orange.svg)](https://www.rust-lang.org)
 ![Unsafe forbidden](https://img.shields.io/badge/unsafe-forbidden-brightgreen.svg)
 
-> **Maintenance mode.** This crate is maintained for correctness and security, not for new
-> features. Bug reports and fixes are welcome and will be reviewed, but the table coverage is
-> unlikely to grow much further.
+> **This crate is in maintenance mode. Bug fixes only — no new features.**
+>
+> Bug reports and fixes are welcome and will be reviewed promptly. Correctness, panics and
+> security issues are in scope. New table support, new API surface and performance work are
+> not, and feature requests will be closed.
 >
 > **For new projects, we recommend [fontations](https://github.com/googlefonts/fontations)**
 > (`read-fonts` and `skrifa`), which is actively developed by Google Fonts, has broader table