Professionalize and secure dissertation template

[humanbeans893]

Summary

• replace the beginner-oriented root documentation with a concise technical reference
• move the shared agent instructions to root-level AGENTS.md and CLAUDE.md
• expand the LuaLaTeX manuscript into a dissertation-ready structure with bilingual abstracts, configurable front matter, submission mode, and a submission checklist
• add manuscript and public-repository safety checks with test coverage
• add least-privilege CI, Dependabot, dependency review, CODEOWNERS, contribution, security, and license files
• add Zotero/Better BibTeX, Zotero MCP, and read-only external file integration guidance

Why

The repository is being prepared for public use as a reproducible dissertation research template. The previous documentation and manuscript skeleton did not cover doctoral submission requirements, publication hygiene, or safe external-file workflows.

Impact

• contributors use pull requests and CI instead of direct changes to main
• manuscript metadata is managed centrally in draft/thesis-config.tex
• draft and final-submission builds are separated
• raw data, credentials, Zotero databases, attachments, and oversized files are checked before publication
• external synchronized folders are mounted read-only

Validation

• UV_CACHE_DIR=.cache/uv uv run pytest — 39 passed
• UV_CACHE_DIR=.cache/uv uv run ruff check .
• UV_CACHE_DIR=.cache/uv uv run ruff format --check .
• python3 tools/public_repo_check.py --history
• make pdf pdf-final supplementary
• python3 tools/thesis_check.py
• generated A4 PDFs: dissertation 11 pages, submission 11 pages, supplementary 1 page

Submission note

The strict submission check intentionally fails while template metadata and manuscript TODOs remain. Authors must replace those values before an actual university submission.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 82da6cd699

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject sensitive filename variants

When a user has .env.local / .env.production or Zotero sidecar files such as zotero.sqlite.bak staged or force-added, this exact-name/suffix check does not flag them; if their contents don't match the narrow secret regexes, make security reports OK even though these are the same credential/application-state files the new public-repo policy is meant to block. Treat the forbidden names as patterns such as .env* except .env.example and zotero.sqlite*, or add equivalent checks here.

Useful? React with 👍 / 👎.