Finalize publication readiness

[davidf9999]

Summary

• record the completed merge and final publication audit
• update clean-clone instructions to use main
• restrict GitHub Actions to read-only repository contents
• reject cyclic parent relationships before geometry traversal
• retain the private visibility state and explicit publication gate

Validation

• 12 tests passed locally, including self-parent and multi-object cycle cases
• workflow YAML parsed successfully
• fresh GitHub clone passed install, validation, rendering refusal, package build, Twine, archive, and Markdown-link checks
• full-history privacy scan found no sensitive project data or credentials