docs(cli): A1 — owen issue template (EN) + Known limitations section

The bug-report template asks exactly what triage needs (version, OS/SDK,
command, exit code, output, optional diagnostic report / sanitized
facts — with an explicit review-before-attaching note), and routes the
documented exit-3/exit-4 behaviors away from the bug queue. The Known
limitations section separates unsupported-by-design (frontend scope,
symbol-tolerant analysis of non-compiling projects, alpha rule families,
static-only evidence, versioned vocabulary, Python requirement) from
bugs, per the alpha first-run contract.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015de4MezSeUnZBoWq1fFU5M

Author: claude

.github/ISSUE_TEMPLATE/owen_cli_report.yml

@@ -0,0 +1,70 @@
+name: "owen CLI problem (alpha)"
+description: "Something went wrong running `owen check` — a crash, a wrong exit code, a confusing message, or a suspected wrong finding."
+labels: ["bug", "owen-cli"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for trying the alpha. Two quick pointers before you file:
+        - **Exit 4** ("no supported input") and **exit 3** (no Python ≥ 3.11) are
+          documented behavior, not bugs — see `owen --help`. If the message was
+          unclear or wrong for your case, that IS worth filing.
+        - **Exit 5** means owen hit an internal error and wrote a diagnostic
+          report to `~/.owen/diag/last-failure.json` — attaching it makes the fix
+          much faster. It contains tool/OS/runtime identity, the command line and
+          the failure cause, and **no source file contents**.
+  - type: input
+    id: version
+    attributes:
+      label: "owen --version"
+      placeholder: "0.1.0"
+    validations:
+      required: true
+  - type: input
+    id: os
+    attributes:
+      label: "OS and .NET SDK"
+      description: "e.g. `Windows 11 / .NET SDK 8.0.4` or `Ubuntu 24.04 / .NET SDK 8.0.4`"
+    validations:
+      required: true
+  - type: input
+    id: command
+    attributes:
+      label: "Exact command"
+      placeholder: "owen check MyApp.sln --format sarif"
+    validations:
+      required: true
+  - type: input
+    id: exit-code
+    attributes:
+      label: "Exit code"
+      description: "`echo $?` (bash) / `echo $LASTEXITCODE` (PowerShell) right after the run"
+    validations:
+      required: true
+  - type: textarea
+    id: output
+    attributes:
+      label: "Output (stderr/stdout)"
+      description: "What owen printed. If you can, re-run with `--debug` and include that instead."
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: artifact
+    attributes:
+      label: "Diagnostic report / sanitized repro (optional but very helpful)"
+      description: |
+        - For exit 5: attach `~/.owen/diag/last-failure.json`.
+        - For a wrong/missed finding: a minimal `.cs` snippet that shows it, or the
+          facts file from `owen check <path> --emit-facts facts.json` — **review it
+          before attaching**; it contains file paths and code structure (names,
+          lines), though no full source text. Never attach anything you consider
+          private without sanitizing it first.
+    validations:
+      required: false
+  - type: textarea
+    id: expected
+    attributes:
+      label: "What you expected instead"
+    validations:
+      required: true

frontend/roslyn/OwnSharp.Cli/README.md

@@ -86,6 +86,34 @@ runtime identity, command line, stage, cause — **no source file contents**;
 sharing facts stays the explicit `--emit-facts` action). `--debug` (or
 `OWEN_DEBUG=1`) prints the full technical cause instead.
 
+## Known limitations (alpha)
+
+What is *unsupported by design* — distinct from bugs (which we want reported):
+
+- **.NET / C# frontend only.** `.cs`, `.csproj`, `.sln`. Anything else is
+  exit 4 ("no supported input"), never a silent clean scan.
+- **A non-compiling project is analyzed anyway** — symbol-tolerantly. Roslyn
+  compile errors are deliberately ignored (the analysis reads symbols, not
+  IL); unresolved external references degrade to *advisory* notes
+  (OWN050/OWN051), never to invented findings. Consequence: a broken build
+  does not fail `owen check`, and findings that depend on an unresolved type
+  may be missed — check the project compiles if a finding you expected is
+  absent.
+- **Alpha rule scope**, not a general leak detector: event-subscription
+  lifetime (the WPF/WinForms `+=`-without-reachable-`-=` family), timers,
+  local `IDisposable` flows, DI lifetime mismatches, pooled-buffer misuse.
+- **Static analysis only.** A finding is a lifetime-contract violation with
+  the evidence the code shows — not a runtime-proven leak. Runtime retention
+  proof is separate tooling.
+- **Vocabulary is versioned and fails loud.** Facts from a mismatched
+  extractor/core pair are a hard exit 2 by contract — never a guess.
+- **Python ≥ 3.11 required** at run time; never auto-installed.
+- Analysis of WPF-shaped code does **not** require Windows; only *running*
+  WPF apps does.
+
+Anything outside this list that ends in a crash, a wrong exit code, or a
+wrong finding is a bug — please use the "owen CLI problem" issue template.
+
 ## Release process
 
 Versioning policy, the release pipeline (`.github/workflows/owen-cli-release.yml`),