Harden audit methodology and OSS maintenance

[MPIsaac-Per]

What changed

• Correct JSONL ingestion for nested Claude Code content blocks, human-message counts, tool joins, and source-file deduplication.
• Harden classifier input and output handling with bounded workers, schema validation, atomic writes, and an import-safe entry point.
• Add a locked Python toolchain, regression tests, contributor and security policy files, release guidance, issue forms, Dependabot, CI, CodeQL, dependency review, and OpenSSF Scorecard.

Why

The original ingest mixed message rows with content blocks and used unstable extraction paths for assistant text and tool results. The repository also lacked automated tests and the standard maintenance surfaces expected of a public methodology project.

Impact

The published methodology is reproducible against a synthetic transcript fixture, classifier failures cannot leave a partial CSV, and future contributions receive automated quality and security checks.

Validation

• 23 pytest tests passed
• 95.43% branch coverage for the classifier
• Ruff, formatter, mypy, and pip-audit passed
• actionlint passed
• zizmor pedantic online audit passed with zero findings

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.