docs: launch stable Sandlot releases

[richardkiene]

Summary

• introduce a professional logo-led README with a macOS-first quick start, clear Sandlot/Sandbox Runtime responsibility split, and focused public guides
• add an AGPL-3.0-aligned changelog and complete operator, configuration, security, diagnostics, development, and release documentation
• validate stable version metadata and build deterministic, script-disabled release artifacts with checksums
• add a manual least-privilege GitHub workflow that atomically claims the tag, creates a draft, uploads through the release-specific host, verifies exact server digests, publishes, and requires an immutable release
• stabilize nested search-worker process contracts with owned process-group cleanup under test-runner contention

Security and release model

• repository code runs only in the read-only verify job
• the write-authorized publish job has no checkout and executes only pinned actions plus reviewed inline GitHub API logic
• tags are claimed atomically at the verified main commit and are never moved or automatically deleted
• assets must be uploaded, exact-size, and match GitHub SHA-256 digests before and after publication
• the first supported release boundary is macOS x64/arm64; Linux remains explicitly deferred

Verification

• npm ci
• npm run release:verify
  • 537/537 unit and contract tests
  • 23 macOS integration tests passed, 1 Linux-only skip
  • 21 installed-package smoke tests passed, 1 Linux-only skip
  • typecheck, clean build, and package-content verification passed
• npm ls --all
• git diff --check
• generated dist tree unchanged
• independent requirements and security reviews approved with no open Critical or Important findings

After merge

A maintainer must enable GitHub immutable releases once, confirm the main security workflow is green at the merge commit, and manually dispatch release.yml with version 0.1.0. The workflow then publishes and verifies v0.1.0.