Polish the public repository surface

[nikitacometa]

Summary

• remove internal planning artifacts, dead migrations, stale operator scripts, and unused adapters
• make Tinyman integration read-only and remove import-time signer derivation
• make contract registration retry-safe with fail-closed contract, pool, and pool-state identities
• apply full-tree Ruff formatting and align contributor, architecture, build, and security documentation
• tighten Docker build context, pinned service images, CI checks, and regression coverage

Verification

• make quality — 388 passed, 38 opt-in skipped, 83.24% branch coverage
• real MongoDB integration suite — 38 passed, including 12 registration concurrency and recovery cases
• Python 3.12 and 3.14 compile checks
• Docker Compose config, production build, non-root runtime smoke, and dependency check
• Trivy — 0 high or critical vulnerabilities and 0 image secrets
• TruffleHog staged-tree scan — 0 verified and 0 unresolved secrets
• Markdown links — all pass

Operational notes

Startup now fails closed on duplicate or conflicting contract, pool, and pool-state identities. NEW_DB_NAME must remain isolated per Algorand network. Reconcile any reported conflicts before rollout; rollback is a revert of this commit after preserving the conflicting records for investigation. No public API response shape changes are introduced.