chore: release-prep packaging (CI, docs, 3.11+ baseline)

[gbradham]

Summary

Salvages the still-valuable packaging work from the stale release-prep-1.0 branch and re-applies it onto current main. Adopts a Python 3.11+ baseline (drops 3.10).

What's included

• ci.yml - main had no test/lint CI (only release-build workflows). Adds lint+format+mypy + a test matrix across Ubuntu/Windows/macOS x Python 3.11-3.13, coverage upload, and a PyInstaller smoke build.
• SECURITY.md, CONTRIBUTING.md - project boilerplate.
• pyproject.toml - requires-python = ">=3.11,<3.14"; license -> {file = "LICENSE"}; dev extra self-references GLIDER[pc,vision,i2c]; adds mypy/pytest-cov + slow/hardware markers; black/ruff/mypy targets bumped to py311.
• uv.lock - regenerated fresh against the new pyproject (not the 9-day-stale lock); now tracked for reproducible installs (gitignore updated). Dropped 3.10-only backports (async-timeout, exceptiongroup, backports-asyncio-runner).
• fix(nodes) - asyncio.TimeoutError -> builtin TimeoutError (UP041), required by the py311 ruff target so CI lint passes.

Deliberately excluded

• The stale auto-generated CHANGELOG.md (predates manual control + flow-function removal - would commit inaccurate history).
• The branch's large GUI-decompose refactor (conflicts with / superseded by the runner architecture now on main).

Testing

• Full suite: 364 passed; ruff + black clean; fresh uv lock resolves cleanly.

🤖 Generated with Claude Code