Prepare DeckDoc v3.3.0 release housekeeping

[deucebucket]

What changed

• establishes VERSION as the canonical source version and advances DeckDoc to 3.3.0
• makes the CLI report, setup output, test runner, and privileged snapshot installer read that canonical version
• adds a full CHANGELOG.md covering v1.0.1 through v3.3.0
• adds the MIT LICENSE file promised by the README
• adds an .editorconfig for consistent repository formatting
• updates the README, roadmap, and live DeckMD footer to the current release and shipped guided-checker state
• adds a 28th regression check that fails when runtime, documentation, site, changelog, or license metadata drifts
• extends local-link validation to include the changelog
• replaces stale “scaffold tests” wording with “DeckDoc tests”

Why

The diagnostic-platform and guided DeckMD merges left the repository functionally current but release metadata was still split across hard-coded v3.2.0 strings. There was no canonical version, changelog, or checked-in license, and the roadmap still described GitHub Pages deployment as future work.

Validation

• Bash syntax validation passes across the CLI, modules, probe, rescue, authorization, and tests
• all 28 DeckDoc regression and safety tests pass
• DeckMD schema validates 6 categories, 12 nested symptoms, 128 facts, 27 contradiction rules, and 15 ranked branches
• local links validate across 32 Markdown files and the Pages entry point
• JavaScript syntax and git diff --check pass
• staged secret scan found no credentials or environment files

After merge, the repository will be tagged and released as v3.3.0, issue #23 will be refreshed to the shipped UI, and already-merged topic branches will be removed.