Clarify new-script workflow and PR guidance

Require new scripts to be submitted to ProxmoxVED (testing repo) before promotion to ProxmoxVE. Update CONTRIBUTING.md with a step-by-step workflow for adding and testing new scripts in ProxmoxVED, and clarify that bug fixes, improvements, and features for existing scripts belong in this repository. Add security vulnerability link, tighten PR guidance (small, focused PRs; CI expectations), and update README links and wording to reflect the new process.

CONTRIBUTING.md

@@ -8,11 +8,19 @@ For detailed coding standards and full documentation, visit **[community-scripts
 
 ## How Can I Help?
 
-| I want to… | Go here |
+> [!IMPORTANT]
+> **New scripts** must always be submitted to [ProxmoxVED](https://github.com/community-scripts/ProxmoxVED) first — not to this repository.
+> PRs with new scripts opened directly against ProxmoxVE **will be closed without review**.
+> **Bug fixes, improvements, and features for existing scripts** go here (ProxmoxVE).
+
+| I want to… | Where to go |
 | :--- | :--- |
-| Add a new script or improve an existing one | Read this guide, then open a PR |
+| **Add a brand-new script** | [ProxmoxVED](https://github.com/community-scripts/ProxmoxVED) — testing repo for new scripts |
+| **Fix a bug or improve an existing script** | This repo (ProxmoxVE) — open a PR here |
+| **Add a feature to an existing script** | This repo (ProxmoxVE) — open a PR here |
 | Report a bug or broken script | [Open an Issue](https://github.com/community-scripts/ProxmoxVE/issues) |
 | Request a new script or feature | [Start a Discussion](https://github.com/community-scripts/ProxmoxVE/discussions) |
+| Report a security vulnerability | [Security Policy](SECURITY.md) |
 | Chat with contributors | [Discord](https://discord.gg/3AnUqsXnmK) |
 
 ---
@@ -43,41 +51,45 @@ Use existing scripts in [`ct/`](ct/) and [`install/`](install/) as reference. Fu
 
 ## Contribution Process
 
-### 1. Fork and clone
+### Adding a new script
 
-Fork the repository to your GitHub account, then clone it:
+New scripts are **not accepted directly in this repository**. The workflow is:
 
-```bash
-git clone https://github.com/YOUR_USERNAME/ProxmoxVE
-cd ProxmoxVE
-```
-
-### 2. Create a branch
-
-```bash
-git switch -c feat/myapp
-```
-
-### 3. Write your scripts
-
-Create the two required files for your service:
-
-- `ct/myapp.sh`
-- `install/myapp-install.sh`
+1. Fork [ProxmoxVED](https://github.com/community-scripts/ProxmoxVED) and clone it
+2. Create a branch: `git switch -c feat/myapp`
+3. Write your two script files:
+   - `ct/myapp.sh`
+   - `install/myapp-install.sh`
+4. Test thoroughly in ProxmoxVED — run the script against a real Proxmox instance
+5. Open a PR in **ProxmoxVED** for review and testing
+6. Once accepted and verified there, the script will be promoted to ProxmoxVE by maintainers
 
 Follow the coding standards at [community-scripts.org/docs/contribution](https://community-scripts.org/docs/contribution).
 
-### 4. Test in ProxmoxVED
+---
 
-**Do not open a PR against the main repo without testing first.**
+### Fixing a bug or improving an existing script
 
-Submit your scripts to [ProxmoxVED](https://github.com/community-scripts/ProxmoxVED) — the dedicated testing repository. PRs to the main repo without prior testing in ProxmoxVED will not be merged quickly.
+Changes to scripts that already exist in ProxmoxVE go directly here:
 
-### 5. Open a Pull Request
+1. Fork **this repository** (ProxmoxVE) and clone it:
 
-Once testing is complete, open a PR from your fork to `community-scripts/ProxmoxVE/main`.
+   ```bash
+   git clone https://github.com/YOUR_USERNAME/ProxmoxVE
+   cd ProxmoxVE
+   ```
 
-Your PR should only contain the files you created or modified. Do not include unrelated changes.
+2. Create a branch:
+
+   ```bash
+   git switch -c fix/myapp-description
+   ```
+
+3. Make your changes to the relevant files in `ct/` and/or `install/`
+
+4. Open a PR from your fork to `community-scripts/ProxmoxVE/main`
+
+Your PR should only contain the files you changed. Do not include unrelated modifications.
 
 ---
 
@@ -120,6 +132,7 @@ dev_mode="trace,keep" bash -c "$(curl -fsSL https://raw.githubusercontent.com/co
 
 - **Website metadata** (name, description, logo, tags) is managed via the website — use the "Report Issue" link on any script page to request changes. Do not submit metadata changes via repo files.
 - **JSON files** in `json/` define script properties used by the website. See existing files for structure reference.
-- Keep PRs small and focused. One script addition or fix per PR is ideal.
-- PRs that fail CI checks or that haven't been tested in ProxmoxVED will not be merged.
+- Keep PRs small and focused. One fix or feature per PR is ideal.
+- PRs with **new scripts** opened against ProxmoxVE will be closed — submit them to [ProxmoxVED](https://github.com/community-scripts/ProxmoxVED) instead.
+- PRs that fail CI checks will not be merged.