Standardize diagnostic release and public surfaces

[stefan-jansen]

Closes #58

Summary

• align package, repository, README, documentation, issue templates, and agent orientation with the ecosystem identity contract
• pin workflow actions and add strict docs, dependency review, CodeQL, clean-wheel, and README quick-start gates
• replace tag publication with a commit-bound 0.1.6 release pipeline using immutable artifacts, manifests, deployed-doc identity, trusted publishing, and post-publication verification

Verification

• pre-commit run --all-files
• uv run ruff check src/ tests/ scripts/
• uv run ruff format --check src/ tests/ scripts/
• uv run ty check
• uv run pytest tests/ -q -n auto --timeout 120 (5349 passed, 75 skipped)
• uv build plus clean-wheel import and README quick start
• uv run mkdocs build --strict plus rendered identity verification
• actionlint
• README local and remote links

Release impact

Prepares version 0.1.6. Publication remains blocked until high-priority correctness issue #59 is fixed and the release commit is explicitly approved.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.