Fix clean Compose build and close local release gaps

[KXHXK]

Summary

• fix the clean-runner Docker build failure caused by assuming the PEP 517 build backend was already present in the uv cache
• update vulnerable frontend transitive dependencies and add a high-severity npm audit CI gate
• reconcile README, current-state, handoff, Agent Harness documentation, evaluation counts, and release evidence with the current implementation
• add an executable security reporting policy and a direct repository link on the static showcase

Root cause

Main run 30744845403 passed repository safety, Python quality, 682 backend tests, the fixed evaluation suites, and 62 frontend tests. compose-smoke failed because the second Dockerfile install used uv sync --offline, while a clean runner had not cached the Hatchling PEP 517 build backend. The project install now remains frozen but may fetch its build backend.

Validation

• uv lock check, Ruff, formatting, and mypy passed
• 421 unit + 261 integration = 682 backend tests passed
• three-business contracts: 42/42
• Agent safety and recovery evaluation: 9/9
• frontend: 19 files / 63 tests; npm audit reports 0 vulnerabilities; production build passed
• clean Linux Docker build passed
• isolated Compose verification passed for three-business database effects, API/MCP restart, recovery-only, and cleanup
• repository safety and 128-document index checks passed

Release boundary

This PR restores the local release candidate and CI build path. The public site remains a static showcase; the writable Agent MVP remains local. Owner walkthrough, recording, final Showcase tag, and Product Release remain separate gates.