Prepare 0.5.0 with audited upgrade and operations documentation

[script3r]

Prepare 0.5.0 with documentation that matches the reviewed implementation and its remaining limits. The upgrade guidance now explains that Django can report no slug-field migration while an old physical index still exists; this was verified using the migration autodetector.

Update the README, changelog, contributing/release/security guidance, review status, API/test docstrings, and source-distribution manifest. Add operations, upgrade, and example-project guides. Correct backend coverage claims, explicit validation behavior, deterministic equality/rotation limitations, and recovery expectations for historical binary/timestamp corruption. The security contact now uses the maintainer email because private GitHub reporting is disabled. Release instructions distinguish signed tags from annotated unsigned tags; no signing identity is configured in the release environment.

Set the package and version regression to 0.5.0. Runtime behavior is unchanged in this preparation PR beyond the previously merged fixes; source changes are docstrings and the version.

Validation:

• All nine tox environments passed 137 library tests and 6 example tests each, including Tink 1.13.0; coverage 97.62%.
• Ruff lint/format, Pyright, dependency audit, and Bandit medium/high checks passed. pip-audit skips the not-yet-published project version itself.
• Wheel/sdist build and strict Twine validation passed; source packages include the documentation and exclude test keysets.
• Thirty Markdown file/anchor links checked across ten documents; documented bulk-write behavior verified against Django.
• Clean installation of the built wheel passed isolated import, ciphertext, binary/datetime/JSON round trips, deterministic equality, cache invalidation, and lookup restriction checks.

Release only after this PR and CI on its main-branch merge commit pass. Tag that exact commit, review the GitHub draft, publish through trusted publishing, and verify the exact version from PyPI in a clean environment.