Prepare v0 for public release review

[bsha6]

Summary

• bind decisions to audited benchmark adapters and provenance
• harden output handling against protected-path aliases and symlink races
• add Apache-2.0, security, architecture, dependency, and trust-boundary documentation
• add Python 3.14 CI, neutral sdist ownership, and installed-wheel GO/NO_GO smoke checks

Verification

• 61 unit tests pass on Python 3.14
• installed wheel produces GO (exit 0) and NO_GO (exit 1)
• normalized sdist has neutral owner metadata and both archives have no local-path/PII hits
• checksum-verified Gitleaks 8.30.1 reports zero findings across all reachable commits
• real read-only ClawProBench checkout remains pinned at c4b8395854fe0752eef435b44f140366efd44d8e with unchanged clean state

The repository remains private. Changing visibility is intentionally out of scope for this PR.