[Erry91]

What this changes

Prepares the repository for going public. The checklist is docs/publishing.md: what is done here, and the switches the owner flips.

• History scanned: no secrets, local paths or private notes, and the only photometric files are synthetic.
• deny.toml and a cargo deny CI job: permissive licences only, no GPL/AGPL.
• SECURITY.md:
  • private reporting for vulnerabilities;
  • "wrong result" reports treated as the most serious bugs.
• CONTRIBUTING.md, with the provenance and life-safety rules from AGENTS.md.
• Issue templates for wrong results and bugs, plus a link for private vulnerability reports.
• publish = false on every crate until a crates.io decision.
• README documentation table updated.

How you verified it

• cargo xtask ci, natively and in the local Linux container; cargo deny check passes. Merged on the local checks (hosted CI unavailable).
• cargo metadata shows every package unpublishable

Life safety (AGENTS.md §2)

• The README and SECURITY say plainly that nothing is checked or validated yet

Never panic (AGENTS.md §3)

• No code changes

Provenance (AGENTS.md §1)

• History checked for standard texts, manufacturer files and plans: none

Records

• docs/publishing.md, docs/status.md, ROADMAP.md log