Harden Apply public release surface

[0xprogrammable]

Outcome

Makes the public Apply repository accurate, navigable, and fail-closed without changing review policy, registry records, intake state, or application semantics.

Changes

• replaces the tiny Mermaid landing flow with a mobile-readable product and authority explanation
• adds an exact checker boundary, a clone-to-run example, visible prelaunch state, and working finding routes
• adds bounded bug and documentation issue forms plus canonical Support and Security links
• documents responsible testing, scoped safe harbor, and the absence of a standing bounty
• separates pull-request intake from post-merge verification
• adds pinned CodeQL analysis and regression tests for the public surface and workflow contract
• publishes a 1280×640 owned social-preview asset
• updates stale Apply, Hookbuilder, migration, and code-maturity wording

Security controls

The live protected branch now requires Node 20, Node 22, and public-intake. The previously required post-merge-only check was removed from the merge gate. Application content remains untrusted data and is never executed by the privileged intake workflow.

Validation

• npm test: 234 tests passed, 1 declared Linux-only skip
• actionlint .github/workflows/*.yml
• all issue-template YAML parsed successfully
• git diff --check
• public checker example returned launch_ready, checkerOnly: true, launchAuthorized: false, independentAudit: false
• canonical public Support, Discussions, Security, Hookbuilder, and website links returned successfully

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.