Harden public project baseline

[lrgthu]

Summary

• clarify the first-run, contribution, diagnostic, and release workflows
• add concise pull request and bug/feature issue templates
• add a dependency-free public-source privacy audit and regression coverage

Repository / contributor workflow

Document branch → pull request → CI → merge as the normal public workflow, preserve the CX Deck identity/runtime/presentation boundaries, and record immutable release tags plus the public-history firewall.

Security / CI

Keep Actions at contents: read, harden the verified zmx download, cancel superseded runs, add the public-source audit to regular CI, and route security-sensitive reports to GitHub Private Vulnerability Reporting.

Validation

• 342 unit/disposable tests passed
• 6/6 real-zmx disposable integration tests passed
• direct-vs-zmx behavior: 11/11 comparisons passed
• T1 capture, T2 MOVE_REUSE, T2 exact restore, and T3 navigation disposable iTerm acceptances passed
• fresh install, reinstall, v0.7-style upgrade, doctor/status, and uninstall preservation passed in a temporary HOME
• Python compile, zsh syntax, YAML parse, diff check, and 71-file public-source audit passed

Non-goals

No product feature, persistence, runtime, session, or version change. CX Deck remains 0.8.1.