chore: point the repo at ClickHouse/ClickStack ahead of the transfer

Repoints links, package metadata, OCI labels, the Go module path,
CODEOWNERS and the review-bot footer from hyperdxio/hyperdx to
ClickHouse/ClickStack. The CLI release notes derive the download URL from
GITHUB_REPOSITORY, and security-audit.yml scans this repo instead of the
hyperdxio org.

deep-resolve now requires write access instead of trusting
author_association, since MEMBER will cover every ClickHouse org member.

docker-compose.yml and the deploy docs pull the app image as
clickhouse/clickstack, published by the previous commit. Adds
SECURITY.md pointing at the ClickHouse security policy.

Merge after the transfer: npm provenance for @hyperdx/cli requires the
package.json repository URL to match the publishing repo.

Author: teeohhem

.changeset/clickstack-repo-links.md

@@ -0,0 +1,6 @@
+---
+'@hyperdx/app': patch
+'@hyperdx/cli': patch
+---
+
+chore: GitHub links (changelog, support, package metadata) now point at `ClickHouse/ClickStack`, and `docker-compose.yml` pulls the app image as `clickhouse/clickstack`

.github/CODEOWNERS

@@ -1,2 +1,2 @@
 # One reviewer is picked round robin by the team's code review settings.
-* @hyperdxio/clickstack-app-devs
+* @ClickHouse/clickstack-app-devs

.github/ISSUE_TEMPLATE/bug-report.md

@@ -17,7 +17,7 @@ paste the URL if it does. If you're working from the repo, `yarn app:dev:local`
 plus onboarding → "Connect to Demo Server" gives you the same data locally. If
 it only happens with your own data, include the table schema
 (`SHOW CREATE TABLE ...`) and source settings.
-See https://github.com/hyperdxio/hyperdx/blob/main/CONTRIBUTING.md#reproducing-issues-and-prs
+See https://github.com/ClickHouse/ClickStack/blob/main/CONTRIBUTING.md#reproducing-issues-and-prs
 -->
 
 **Reproduces on play.hyperdx.io?** <!-- yes (link) / no / didn't try -->

.github/ISSUE_TEMPLATE/config.yml

@@ -7,7 +7,7 @@ contact_links:
     about:
       For usage questions, setup help, and general discussion, ask on Discord.
   - name: First-time contributor?
-    url: https://github.com/hyperdxio/hyperdx/blob/main/CONTRIBUTING.md#getting-vouched
+    url: https://github.com/ClickHouse/ClickStack/blob/main/CONTRIBUTING.md#getting-vouched
     about:
       No need to open an issue to get vouched. Open your pull request and a
       maintainer vouches from there.

.github/ISSUE_TEMPLATE/feature-request.md

@@ -26,4 +26,4 @@ labels: enhancement, Needs Feedback
 New issues start as `Needs Feedback` so we can discuss scope before anyone
 writes code. Once a maintainer swaps that for `Accepting PR`, the issue is ready
 to be picked up — see
-[CONTRIBUTING.md](https://github.com/hyperdxio/hyperdx/blob/main/CONTRIBUTING.md#from-issue-to-pull-request).
+[CONTRIBUTING.md](https://github.com/ClickHouse/ClickStack/blob/main/CONTRIBUTING.md#from-issue-to-pull-request).

.github/VOUCHED.td

@@ -1,4 +1,4 @@
-# Vouched contributors for hyperdxio/hyperdx.
+# Vouched contributors for ClickHouse/ClickStack.
 #
 # Pull requests from GitHub users who are not in this list are closed
 # automatically by .github/workflows/vouch.yml. See CONTRIBUTING.md for how to

.github/prompts/code-review.md

@@ -1,4 +1,4 @@
-REPO: hyperdxio/hyperdx
+REPO: ClickHouse/ClickStack
 PR: #{{PR_NUMBER}}
 
 Review this pull request.

.github/scripts/code-review/review-comments.cjs

@@ -25,7 +25,7 @@ const MAX_BODY = 65536;
  * FOOTER repeats the rule and this anchor; the anchor test pins both to the AGENTS.md heading.
  */
 const GUIDE_URL =
-  'https://github.com/hyperdxio/hyperdx/blob/main/AGENTS.md#responding-to-review-feedback';
+  'https://github.com/ClickHouse/ClickStack/blob/main/AGENTS.md#responding-to-review-feedback';
 const GUIDE_LINK = `[How to respond](${GUIDE_URL})`;
 
 /**

.github/workflows/deep-resolve.yml

@@ -8,8 +8,9 @@ name: Deep Review Resolver
 # Limitations:
 #   - Same-repo PRs only. Fork PRs cannot be pushed to from CI with the
 #     default GITHUB_TOKEN; the workflow exits early on forks.
-#   - Collaborator-gated. The job `if` requires OWNER/MEMBER/COLLABORATOR
-#     association on the triggering comment to prevent random drive-by use.
+#   - Write-gated. The job `if` requires OWNER/MEMBER/COLLABORATOR association
+#     on the triggering comment, and the first step checks the commenter has
+#     write access, since MEMBER covers every org member.
 #   - Single-shot. Re-trigger by commenting `/just-fix-it` again after the
 #     follow-up deep-review run posts an updated finding list.
 
@@ -38,6 +39,28 @@ jobs:
       actions: read
 
     steps:
+      # author_association MEMBER covers every org member, not just people with
+      # write access to this repo. Check the real permission before touching the PR.
+      - name: Require write access
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const username = context.payload.comment.user.login;
+            let p = {};
+            try {
+              const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                username,
+              });
+              p = data.user?.permissions ?? {};
+            } catch (e) {
+              if (e.status !== 404) throw e;
+            }
+            if (!(p.admin || p.maintain || p.push)) {
+              core.setFailed(`${username} has no write access to this repo; ignoring /just-fix-it.`);
+            }
+
       - name: Acknowledge trigger
         uses: actions/github-script@v9
         with:

.github/workflows/deep-review.yml

@@ -850,7 +850,7 @@ jobs:
           # collapsed P3 block. Twin of INLINE_FOOTER_BY_SEVERITY / AGENT_NOTICE
           # in .github/scripts/code-review/review-comments.cjs; the anchor test
           # there pins both to the AGENTS.md heading.
-          FOOTER='<sub>No finding blocks merge automatically. A maintainer will expect P0/P1 findings in code this PR changes to be fixed; P2/P3 are your call -- fix or reply. Never fix findings about surrounding code here; reply instead. Do not widen the PR. [How to respond](https://github.com/hyperdxio/hyperdx/blob/main/AGENTS.md#responding-to-review-feedback)</sub>'
+          FOOTER='<sub>No finding blocks merge automatically. A maintainer will expect P0/P1 findings in code this PR changes to be fixed; P2/P3 are your call -- fix or reply. Never fix findings about surrounding code here; reply instead. Do not widen the PR. [How to respond](https://github.com/ClickHouse/ClickStack/blob/main/AGENTS.md#responding-to-review-feedback)</sub>'
           # Only when there is something to triage, as renderSummary does for its
           # notice: a clean review or a zero-coverage (unhealthy-sandbox) one gets
           # no footer. Findings sit under a `### ` severity heading or, for P3