Export bran-dev 5a537b9 public snapshot

[1wgrumph]

What changed

• Make alphazede/bran the BRAN development home: pull requests are welcome and the snapshot-only contributing note is gone.
• Route security and conduct reports through GitHub private advisories; remove the personal mailbox from shipped files.
• Publish the remaining public-safe product surface from private source 5a537b986c4a5e7f273e668bb0da1113bd4f368d: enterprise-document evidence envelope, Google attestation fixtures and contract checks, and Document AI recorded-response adapter.
• Keep native SDoc out of this snapshot.

Why

Private bran-dev is being retired. The public repository must become the canonical source without shipping private plans, submissions, agent instructions, machine paths, personal email, or SDoc.

Validation

• ./tools/cutover/publish-hygiene.sh — PASS, files=336, markdown=14, export_surfaces=1
• python3 tools/ci/public_boundary_check.py — PASS, scanned=207
• python3 tools/ci/public_export.py snapshot --source-ref HEAD — PASS, source_commit=5a537b986c4a5e7f273e668bb0da1113bd4f368d, files=169
• identity scan of the snapshot for home paths, legal name, Gmail, Alphazedehq/, and /tmp/codex-clipboard — empty
• SDoc path scan of the snapshot — empty
• python3 tools/ci/public_export.py check --public-dir <public-checkout> — PASS, files=169
• ./tools/ci/check.sh --fast on the source revision — PASS (278 core tests, 52 CLI tests, enterprise envelope 4/7, google attestation 6/8)

Residual risk

• GitHub Actions fast and CodeQL checks on this PR have not been observed yet; this PR stays draft until they are green.
• Native SDoc remains only in the private archive, not in this tree.
• Historical public git authors on earlier commits still contain a legal name and Gmail; this commit uses the GitHub noreply address. Public history is not rewritten.
• Owner review of the exact exported diff and a merge commit (not squash) are still required before this lands on public main.