chore(security): promote public boundary to prod

[allenwoods]

Summary

• promote PR chore(landing): 从 git 仓库移除静态页面资源 #194's removal of tracked landing assets to prod;
• promote PR chore(security): establish public repository boundary #195's public/private repository boundary, content-only publisher, CI policy, and development skill guidance;
• leave the production server's already deployed landing tree untouched.

Safety boundary

• This PR performs no deployment.
• Do not run rsync --delete after merge.
• Do not run redeploy.sh; the landing content is already deployed.
• The Git deletion only stops tracking externally owned files. It must not be mirrored destructively to production.

Bootstrap verification

• PR chore(landing): 从 git 仓库移除静态页面资源 #194 was already merged into the default development branch.
• PR chore(security): establish public repository boundary #195 content-publisher check passed and its 52 boundary tests plus 24 publisher tests passed locally.
• The immutable pre-push hook is installed from merged default commit bd595ea04198b2cfc24e9b8def175e3d09ff545c.
• Because prod does not yet contain the trusted pull_request_target workflow, this one promotion requires the same documented bootstrap exception. The next cleanup PR must demonstrate the trusted gate on its exact head SHA.