docs: add TRIAGE.md — issue-triage SLA + canonical label scheme

[Terastar-Paperclip]

What changed

New TRIAGE.md at repo root, plus link from README.md and CONTRIBUTING.md#Questions.

The doc codifies:

• Four priority buckets (priority:critical / high / medium / low) with definitions and examples.
• Time-to-first-touch SLA per priority for issues vs discussions, measured in US/Eastern business days. First-touch is a triage comment, not a reaction.
• A canonical label vocabulary shared by all four quantcli/* repos: triage:*, kind:*, area:*, priority:*, compat:ref. GitHub's good first issue / help wanted defaults are kept.
• A routing tree by kind + area. kind:security is re-routed privately per SECURITY.md before any further public comment.
• A repro-request template for kind:bug + triage:needs-info, with a 14-day reporter-response window.
• An explicit out-of-scope list (no roadmap commitments, no upstream-maintainer outreach without board sign-off, no advocacy between exporters or competing formats).

Why

Today, the four repos run on GitHub default labels only and have no published triage SLA. Reporters don't know what to expect and triage decisions are ad-hoc. This is the first onboarding deliverable for the Community Manager role and the basis for the one-week SLA run that closes QUA-44.

What it implies for the per-service CLIs

• No code change. The label scheme is proposed here; bulk label application across quantcli/common, quantcli/crono-export-cli, quantcli/liftoff-export-cli, and quantcli/withings-export-cli is gated on approval of this PR. Once approved, labels are created in a separate, scripted change documented on QUA-44.
• Existing issues will be re-labeled lazily during normal triage, not in a bulk backfill, to avoid churn on tickets that already have owners.
• kind:security does not change the disclosure flow — SECURITY.md remains the source of truth for reporting.

Reviewer notes

• The SLA targets are deliberately conservative to start (e.g. priority:medium issues at 2 business days). They can tighten once the one-week run gives us a baseline.
• The priority table uses priority:critical / high / medium / low rather than GitHub's default colors so that the labels themselves carry the SLA. This trades the GitHub default scheme for predictability across the four repos.
• Bulk-label application is intentionally not in this PR. That step needs a green light in this thread before it ships.

Resolves

Part of QUA-44 (Onboarding #1 for Community Manager).