Add UnitSentinel governance and dependency maintenance

[omar07ibrahim]

What changed

• add private vulnerability reporting with graph, certificate, and ONNX input
  boundaries;
• document the exact maintainer, adversarial-test, and evidence workflow;
• add an honest unreleased changelog without implying a public release;
• configure grouped weekly updates for Python, the npm evidence renderer, and
  GitHub Actions;
• normalize text and explicitly classify raster/model/database formats;
• include the governance files in the exact tracked source-distribution
  contract instead of weakening its closed-surface check;
• keep generated evidence candidates mode 0600 until reviewed and deliberately
  published through Git, with a regression test for the permission boundary.

Verification

• all four commits are linear and authored and committed only by Omar Ibrahim;
• the branch is exactly four commits ahead of main and zero behind;
• all 54 manifest-declared visual files independently matched their SHA-256 and
  byte counts;
• representative architecture, CLI drift, measured-scaling, ONNX architecture,
  and ONNX GIF assets were inspected at original resolution;
• generated evidence bytes are unchanged; README test-count and changelog text
  are synchronized with the security regression test;
• the complete CI/evidence/CodeQL/dependency gates must pass before merge.

Boundaries

No license or release is added. That maintainer decision remains tracked in
#6. No production graph, model, secret, or personal data is introduced.